Security scans are calling out the setting of big_pipe_nojs cookie without the 'secure' flag set as an OWASP Vulnerability
5.2.2 Cookie Security: Cookie not Sent Over SSLMedium
CWE-614
OWASP Top 10: A3
PCI 3.2: 4.1 Use strong cryptography and security protocols, 6.5.4 Insecure Communications
While this is reflected as a security issue, I dont think it should be formally reported as such.
N/A
where big_pipe_nojs cookie is set, ensure the 'secure' flag is set
N/A
N/A
N/A
N/A
N/A
Needs work
9.5
The change is currently missing an automated test that fails when run with the original code, and succeeds when the bug has been fixed.
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
I have re-rolled the patch taking into account the feedback in #14. I am not sure what to do about the tests as I'm not sure how you can mock a secured v non secured http request
I have added re-roll patch of the patch in #18 for 11.x version