| name | cis-tomcat9-v120-6.4 |
| description | Ensure secure is set to true only for SSL-enabled Connectors |
| category | cis-tomcat |
| version | 1.2.0 |
| author | cyberstrike-official |
| tags | ["cis","tomcat","linux","java","connector","ssl","tls"] |
| cis_id | 6.4 |
| cis_benchmark | CIS Apache Tomcat 9 Benchmark v1.2.0 |
| tech_stack | ["linux","tomcat","java"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
6.4 Ensure secure is set to true only for SSL-enabled Connectors (Automated)
Profile Applicability
• Level 1
Description
The secure attribute is used to convey Connector security status to applications operating over the Connector. This is typically achieved by calling request.isSecure(). Ensure the secure attribute is only set to true for Connectors operating with the SSLEnabled attribute set to true.
Rationale
Accurately reporting the security state of the Connector will help ensure that applications built on Tomcat are not unknowingly relying on security controls that are not in place.
Audit Procedure
Review the server.xml and ensure the secure attribute is set to true for those Connectors having SSLEnabled set to true. Also, ensure the secure attribute is set to false for those Connectors having SSLEnabled set to false.
Remediation
For each Connector defined in server.xml, set the secure attribute to true for those Connectors having SSLEnabled set to true. Set the secure attribute to false for those Connectors having SSLEnabled set to false.
<Connector SSLEnabled="true"
…
secure="true"
…
/>
…
<Connector SSLEnabled="false"
…
secure="false"
…
/>
Default Value
The secure attribute is set to false.
References
- http://tomcat.apache.org/tomcat-9.0-doc/ssl-howto.html
CIS Controls
Controls Version: v8
