漏洞修复---Session Cookie Does Not Contain the “Secure“ Attribute和HTTP Security Header Not Detected

1. 漏洞

Qualys扫描出来2个漏洞要修复
漏洞1:

Session Cookie Does Not Contain the "Secure" Attribute
...略
SOLUTION:
Apply the "secure" attribute to session cookies to ensure that they are sent via HTTPS only. More information about this flag can be
found here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie.

漏洞2:

HTTP Security Header Not Detected
...略
SOLUTION:
Note: To better debug the results of this QID, it is requested that customers execute commands to simulate the following functionality: curl -lkL --
verbose.
CWE-693: Protection Mechanism Failure mentions the following - The product does not use or incorrectly uses a protection mechanism that
provides sufficient defense against directed attacks against the product. A "missing" protection mechanism occurs when the application does not
define any mechanism against a certain class of attack. An "insufficient" protection mechanism might provide some defenses - for example, against
the most common attacks - but it does not protect against everything that is intended. Finally, an "ignored" mechanism occurs when a mechanism is
available and in active use within the product, but the developer has not applied it in some code path.
Customers are advised to set proper X-Content-Type-Options (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-
Options) and Strict-Transport-Security (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) HTTP response
headers.
Depending on their server software, customers can set directives in their site configuration or Web.config files. Few examples are:
X-Content-Type-Options:
Apache: Header always set X-Content-Type-Options: nosniff
HTTP Strict-Transport-Security:
Apache: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Nginx: add_header Strict-Transport-Security max-age=31536000;
Note: Network devices that include a HTTP/HTTPS console for administrative/management purposes often do not include all/some of the security
headers. This is a known issue and it is recommend to contact the vendor for a solution

2. 修复方法

nginx.conf加入以下配置
注意,如果没有/ 一定要加一段/的location

server {
        add_header X-Content-Type-Options nosniff;
        add_header Strict-Transport-Security max-age=31536000;
        add_header Set-Cookie "/; Secure; HttpOnly; SameSite=None";
location / {
		proxy_store off;
		proxy_redirect  off;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header Host $http_host;
		client_max_body_size    1000m;
		proxy_connect_timeout 600;
		proxy_send_timeout 600;
		proxy_read_timeout 600;
		add_header  Nginx-Cache "$upstream_cache_status";
		add_header Set-Cookie "HttpOnly";
		add_header Set-Cookie "Secure";
		add_header X-Content-Type-Options nosniff;
		add_header Strict-Transport-Security max-age=31536000;
		add_header Set-Cookie "/; Secure; HttpOnly; SameSite=None";  
	}
}

由于公司Qualys每次都有费用发生,以上配置可能有没用的配置夹杂在内.但这样的配置肯定是能修复这2个漏洞
各位如果可以多次扫描可以尝试下去掉以下三行以外的配置看是否可以.如果有最精简的结果记得给我留言,谢谢

		add_header X-Content-Type-Options nosniff;
		add_header Strict-Transport-Security max-age=31536000;
		add_header Set-Cookie "/; Secure; HttpOnly; SameSite=None";