I want to make sure that session-related cookie data is sent over secure channels. How can I do this?

Article Comments

This article applies as of PRTG 20.3.60

Force "secure" flag for HTTP cookies

As of PRTG 20.3.60, PRTG provides the option to force the "secure" flag for HTTP cookies. The corresponding registry key option allows you to do this. It is not mandatory, however, if you do not configure the registry hack, cookies will not have the "secure" flag set. Forcing the flag is especially necessary if you use SSL offloading.

Important: If you enable this registry hack, clients that reach the PRTG web server without HTTPS, either directly or behind the load balancer, will not be able to stay logged in to PRTG because the authentication cookie will not work.

Steps to take

Caution: Back up your system before you manipulate the Windows registry!

  1. Open the registry editor and navigate to the following key:
    1. On a 64-bit Windows system, navigate to HKEY_LOCAL_MACHINE\Software\Wow6432Node\Paessler\PRTG Network Monitor\Server\Webserver
    2. On a 32-bit Windows version, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Paessler\PRTG Network Monitor\Server\Webserver
  2. Create a new DWORD value:
    1. In the current path, right-click to open the context menu.
    2. Select New | DWORD.
    3. Name the new value forceCookiesSecure.
  3. Set the value of forceCookiesSecure:
    1. Right-click forceCookiesSecure .
    2. Select Modify.
    3. Under Value data, enter 1.
    4. Confirm with OK.
  4. Restart the PRTG core server to activate the settings.

PRTG now forces the "secure" flag for HTTP cookies.


Mar, 2021 - Permalink