Repository navigation
Help with Qualys security test #40041
Unanswered
muriloSGomesDr
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hello everyone!
We are using keycloack 25.0.1 in our Grafana-based application to provide more security and reliability to our customers. However, one of these customers applied the Qualys TotalAppSec security verification test and identified a medium vulnerability and two security weaknesses information. The customer wants this vulnerability and the two security weaknesses to be resolved, so I am asking for the help.
Vulnerability:
Information Security Weaknesses:
Third-Party Cookies Collected: The domain is being used as the same as the application and Revoke Refresh Token was activated and Refresh Token Max Reuse with value 0. Is this the only one solution, or is there something else that can be done to solve this problem?
Cookie without the SameSite attribute: I honestly don't know how to solve this topic. Can anyone suggest a solution or even an article that invalidates this point? One solution that could solve this would be to set the cookie as strict, but I don't think I have access to these settings.
Thank you.
All reactions