https://bugzilla.redhat.com/show_bug.cgi?id=2075518

Description of problem:

- An internal security audit discovered that Horizon session cookies are being created without the HttpOnly flag even though we set HorizonSecureCookies to true in our environment files.

- According to the KCS article at https://access.redhat.com/solutions/4764241 the relevant Django flag should be set manually in the dashboard configuration file.


Version-Release number of selected component (if applicable):

- Red Hat OpenStack 16.2.1 (Z1)


Actual results:

- From the Customer point of view, the workaround described in KCS 4764241 is unacceptable because those modifications would get lost every time the overcloud configuration is updated by TripleO and it would require a manual intervention on all controllers followed by a restart of the dashboard.


Expected results:

- The customer expectation is a fix (set of HttpOnly via Tripleo) of this problem in a next Z stream of OSP 16.2


Additional info:

- OpenStack recommendations on Cookies, related to the OpenStack O&M Dashboard (Horizon GUI), are available at: https://docs.openstack.org/security-guide/dashboard/cookies.html

- In term of common consequences, connected to the missing HttpOnly flag in the Cookies related to the O&M OpenStack Dashboard (Horizon GUI), these could identified in these two areas [1][2]

[1] Confidentiality impact:               
If the HttpOnly flag is not set, then sensitive information stored in the cookie may be exposed to unintended parties.

[2] Integrity impact:
If the cookie in question is an authentication cookie, then not setting the HttpOnly flag may allow an adversary to steal authentication data (e.g., JWT and refresh token are written back to the browser in HTTP cookies. HttpOnly prevents JavaScript from accessing them, making them less vulnerable to theft. ) and assume the identity of the user.