When running AdminUI, JSESSIONID cookie was issued by the application and does not have the secure flag set.
The cookie appears to contain a session token, which may increase the risk associated with this issue.
Policy Server Version: 12.8 SP6a on Linux x86_64;
AdminUI (WAM UI) 12.8SP6a on Linux x86_64.
The Siteminder AdminUI is hosted on a JBOSS Wildfly appplication server. The 'secure' and 'HTTPOnly' flags for the cookies set by JBOSS (e.g. JSESSIONID) (1) are controlled within the following file:
<administrative_ui_installation_path>\standalone\deployments\iam_siteminder.ear\user_console.war\WEB-INF\web.xml