5
Hi Team,
One of our customers has executed a vulnerability analysis against the NAV 2018 web client.
The tool reported the following vulnerabilities, so it's on us now to provide clarifications.
1. Slow HTTP POST vulnerability on the main URL (https://domainname.com/nav_web
2. Cookie Does Not Contain The "secure" Attribute (domainname.com/.../SignIn)
We appreciate your feedback on the above matters.
Best Regards,
Angelos
*This post is locked for comments
Thanks Stefano for the prompt response.
For 1 this is what i was thinking as well.
For 2 however I had no idea. We always use HTTPS in any case.
Just my opinion:
1) Not true. to prevent Slow HTTP Post vulnerabily NAV server has an option to set a request timeout as per your needs.
2) Cookie Does Not Contain The "secure" Attribute: NAV 2018 is stateless, doesn't use cookies and uses Windows Authentication. However, this could be a "problem" if you use HTTP over internet. But you can use HTTPS if you want more security over the internet (recommended).
#1
André Arnaud de Cal...
291,622
Super User 2024 Season 2
#2
Martin Dráb
230,354
Most Valuable Professional
#3
nmaenpaa
101,156
Share
Report
All responses (
Answers (
