SAP Cookies does not have secure attribute

Question

Cookies remain without Secure Attribute after changing ticket_only_by_https = 1, SystemCookiesHTTPSProtection=true, and ume.logon.security.enforce_secure_cookie=True.
1.)ABAP: sap-appcontext cookies
2.)Portal: com.sap.engine.security.authentication.original_application_url   
Security guidelines advice us to put all cookies into secure flag.
1.) What are these cookies, the information it contain and how are they use?
2.) Is it necessary to set this cookies to secure flag? If not is how does SAP handles possible cookie hijacking?

Answer 1

Hi Jason,
The cookie "com.sap.engine.security.authentication.original_application_url" is used to remember the originally called URL, when - to retrieve this URL - a logon is needed. After the successful login, it is used to redirect to the originally called application URL (and will be deleted then).
It is also (mis)used to interpret for the SPNego login module if there already was a failed approach to login via SPNego. So if the auth request sees this cookie, it does not try to run SPNego but skips it.
The value is encoded; only the information if the initial request was GET or POST is put in clear text in front of the value, separated by a "#" char.
The code setting the cookie can be found in class com.sap.engine.interfaces.security.auth.AbstractWebCallbackHandler in line 1200++ - there someone could add the secure flag.
Hope it helps
Detlev