BO Cookie without Secure Flag

[Tu Chu]

Hi,

I testing on PS 1.7.3. I discovered a security problem. At BO, the Set-cookie missing the Secure-Flag (in FO, not problem). 
I had config Enable SSL and Enable SSL on all pages.

This is an issue or I missing another config?

[David Aguilar]

On 2/27/2019 at 9:29 AM, Tu Chu said:

Hi,

I testing on PS 1.7.3. I discovered a security problem. At BO, the Set-cookie missing the Secure-Flag (in FO, not problem). 
I had config Enable SSL and Enable SSL on all pages.

This is an issue or I missing another config?

I have the same issue, actually an scan from Rapid7 had detected this issue in my website.

the remedation steps: 

Use HTTP X-Frame-Options
Add the Secure flag to cookies sent over SSL