Page History

Blueriq Runtime and Publisher are using the HTTP session to store data before it is persisted. As stated by OWASP, the session timeout should be set as low as possible (https://owasp.org/www-community/Session_Timeout). Depending on your infrastructure it is possible to set the Secure flag of the session cookie (https://owasp.org/www-community/controls/SecureCookieAttribute). Both the session timeout and the secure flag can be configured by following the steps in the articles below:

By default the secure flag of the session cookie is enabled since release 16.0 and onwards. In earlier versions, the property was disabled by default.

Disabling the secure session cookie from Blueriq version 14.7 onwards can be done by configuring the following property:

Code Block

language	text
title	application.properties

blueriq.session.cookie.secure=false

Note

When the secure flag is set on the session cookie, the cookie will only be sent to the server over a secured connection (HTTPS).

If your runtime runs in HTTP mode, despite the cookie having the secure flag, you will get errors about Blueriq Sessions not being found or being expired.

Additionally, the SameSite attribute can be set on the session cookie: Security: SameSite.

Space shortcuts

Page tree

Versions Compared

Old Version 5

New Version Current

Key