DX NetOps Spectrum 25.4.x Missing Same Site Cookie Attribute

Products

• Network Observability
• Spectrum

Issue/Introduction

During Security Assessment, it was observed that the application cookies are configured without the SameSite attribute in Spectrum OneClick.

Impact - Missing SameSite cookie attributes may increase the risk of Cross-Site Request Forgery (CSRF) attacks and unintended cross-site cookie transmission.

Remediation - It is suggested to configure cookies with the SameSite attribute as Lax or Strict based on business requirements and implement secure cookie handling mechanisms.

Reference- CWE : CWE-1275: Sensitive Cookie with Improper SameSite Attribute

CVE/Standard - CWE-1275OWASP Top 10 2025 – A07

Environment

DX NetOps Spectrum 25.4.5 to 25.4.11

Resolution

This SameSite cookie attribute will be part of the $SPECROOT/tomcat/conf/context.xml file as shown below:

<CookieProcessor className="org.apache.tomcat.util.http.LegacyCookieProcessor" sameSiteCookies="Lax" />

This can be updated manually on site.

The property is added permanently to the $SPECROOT/tomcat/conf/context.xml via the tomcat upgrade script from release 25.4.12 onwards.