samesite=strict attribute should be set

TS002586394


Customer reported vulnerabilities as part of penetration testing which needs samesite attribute to be set either Strick or Lax.

BAW 18.0.0.2 & WAS 8.5.5.14

https://bpmetispa.ilab.discoverfinancial.com/ProcessAdmin/ProcessAdmin/com.lombardisoftware.processadmin.ProcessAdmin/ProcessAdmin.jsp
The lombardi.locale.name cookie does not have the SameSite attribute set. Using this attribute helps protect against Cross-Site-Request-Forgery (CSRF) attacks, by restricting when cookies will be sent to the site. CSRF attacks are a class of confused deputy attacks that exploit the behavior of browsers always sending authorization cookies in requests.

https://bpmetispa.ilab.discoverfinancial.com/ProcessPortal/dashboards/SYSRP/teamworks/script/coachNG/com/ibm/bpm/coach/resources/iframe_history.html?build=201902011241
The com.ibm.bpm.servlet.LaunchDashboardServlet.portalQueryString cookie does not have the SameSite attribute set.

https://bpmetispa.ilab.discoverfinancial.com/ProcessPortal/dashboards/SYSRP/RESPONSIVE_WORK
The JSESSIONID cookie does not have the SameSite attribute set.

https://bpmetispa.ilab.discoverfinancial.com/ProcessPortal/dashboards/SYSRP/RESPONSIVE_WORK
The com.ibm.bpm.servlet.LaunchDashboardServlet.defaultAvatarKey cookie does not have the SameSite attribute set.

https://bpmetispa.ilab.discoverfinancial.com/teamworks/cs_welcome.lsw
The TeamWorks cookie does not have the SameSite attribute set.

https://bpmetispa.ilab.discoverfinancial.com:443/teamworks/script/coachNG/com/ibm/bpm/coach/resources/iframe_history.html?build=201902011241
The isBidi cookie does not have the SameSite attribute set.

https://bpmetispa.ilab.discoverfinancial.com/bpm/notification/cometd/handshake
The BAYEUX_BROWSER cookie does not have the SameSite attribute set.

https://bpmetispa.ilab.discoverfinancial.com/teamworks/webasset/2064.c7680890-5385-3f24-bbc9-20da937ac8c4/W/coachview.helper.min.zip/scripts/coachViewHelper.js?build=201902011241

The application does not invalidate cookie values created prior to login after a successful login has occurred. As a result, the session identifier stays the same before, during, and after a user has logged in or out. An attacker may attempt to force a user into using a specific session identifier, then hijack the session once the user has logged in. The cookie was found to be vulnerable to this problem.