Gateway

Enforce the HttpOnly flag on authentication cookies

January 8, 2024

Contributed by:

Starting from Citrix Gateway release 13.0-89.x and later, the HttpOnly flag is available on the authentication cookies of VPN scenarios that is, NSC_AAAC and NSC_TMAS cookies. The NSC_TMAS authentication cookie is used during the nFactor authentication and the NSC_AAAC cookie is used for the authenticated session. The HttpOnly flag on a cookie restricts the cookie access using the JavaScript document cookie option. This helps in preventing cookie theft due to cross-site scripting.

Supported scenario

The HTTPOnly flag is supported for nFactor authentication.

Behavior when Citrix ADC AAA parameter’s HttpOnlyCookie knob is used along with tmsession’s HttpOnlyCookie knob:

When the authentication, authorization, and auditing parameter’s httpOnlyCookie knob is enabled and nFactor authentication is used, the authentication, authorization, and auditing parameter’s HttpOnlyCookie knob overrides the TM session’s HttpOnlyCookie knob. Also, both NSC_TMAS and NSC_AAAC are marked HttpOnly irrespective of the session type; whether it is a VPN session, TM session, or during nFactor authentication.
If the HttpOnlyCookie knob is disabled, the HttpOnly flag is not set for a VPN session. For the authentication, authorization, and auditing scenario, the HttpOnly flag is set based on the TM session knob value.

Configure the HttpOnly feature by using the CLI

Enable the HttpOnly flag

 set aaa parameter -httpOnlyCookie ENABLED
 <!--NeedCopy-->

Check the status of the HttpOnly feature
```
 show aaa parameter
 
```

Limitations

When the HttpOnly feature is enabled, the Home Page button on the Citrix Secure Access client does not work.
HttpOnly flag is not set in any classic authentication.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Enforce the HttpOnly flag on authentication cookies

January 8, 2024

Contributed by:

January 8, 2024

Contributed by:

Enforce the HttpOnly flag on authentication cookies

Supported scenario

Configure the HttpOnly feature by using the CLI

Limitations

In this article