Error: Unsecure DX AXA cookies flagged in vulnerability scan - DX APM SaaS

Products

• DX Operational Observability
• DX Application Performance Management

Issue/Introduction

Introduction Vulnerability or penetration tests may flag DX Experience Analytics (AXA) Browser Agent cookies as unsecure because they lack HttpOnly and Secure attributes. This occurs when the Browser Agent is configured to use cookies for session tracking or response decoration.

Symptoms Security scanners report the following cookies as a vulnerability:

• x-apm-ba-BAFinPrt
• x-apm-brtm-bt-pv
• x-apm-brtm-bt-p

Environment

• DX Operational Observability SaaS and On-Premise
• DX App Experience Analytics (AXA) SaaS and On-Premise

Cause

By default, the AXA Browser Agent uses these cookies to maintain session context and performance data. These cookies do not include the HttpOnly or Secure flags in certain configurations.

Resolution

If these cookies cause security compliance failures, disable them in the application profile. Disabling cookies prevents the Browser Agent from storing these specific tokens on the client browser.

1. Log in to the DX AXA console.
2. Navigate to the specific Application profile.
3. Locate the Allow Cookies checkbox.
   
   
4. Uncheck Allow Cookies to disable the generation of these tokens.
5. Save the profile changes.

If the scanner continues to report the vulnerability after disabling the setting:

• Capture a HAR file or browser screenshots of the network headers.
• Confirm if the flags are originating from a cached version of the agent snippet.

Additional Information

For more information refer to the "Configure the Browser Agent Response Decoration"