vSphere UI must restrict its cookie path.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-256795	SRG-APP-000223-WSR-000011	VCUI-70-000018	SV-256795r889384_rule	2023-06-15	1

Description
Cookies are used to exchange data between the web server and the client. Cookies, such as a session cookie, may contain session information and user credentials used to maintain a persistent connection between the user and the hosted application since HTTP/HTTPS is a stateless protocol. vSphere UI is bound to the "/ui" virtual path behind the reverse proxy, and its cookies are configured as such. This configuration must be confirmed and maintained.

Description

Cookies are used to exchange data between the web server and the client. Cookies, such as a session cookie, may contain session information and user credentials used to maintain a persistent connection between the user and the hosted application since HTTP/HTTPS is a stateless protocol. vSphere UI is bound to the "/ui" virtual path behind the reverse proxy, and its cookies are configured as such. This configuration must be confirmed and maintained.

ℹ️ Check
At the command prompt, run the following command: # xmllint --format /usr/lib/vmware-vsphere-ui/server/conf/context.xml \| xmllint --xpath '/Context/@sessionCookiePath' - Expected result: sessionCookiePath="/ui" If the output does not match the expected result, this is a finding.

✔️ Fix
Navigate to and open: /usr/lib/vmware-vsphere-ui/server/conf/context.xml Add the following configuration to the <Context> node: sessionCookiePath="/ui" Example: <Context useHttpOnly="true" sessionCookieName="VSPHERE-UI-JSESSIONID" sessionCookiePath="/ui"> Restart the service with the following command: # vmon-cli --restart vsphere-ui