How Does Cookie Tampering Protection Work? - SonicWALL SMA 400 Administration Manual

You can generate and download the PCI report file on the Web Application Firewall > Status page.
NOTE: This is not an official PCI Compliance report. It is for your self-assessment only.
In the report cover, the following information is displayed:
• The model, serial number, and firmware version of the appliance
• The user name of the person who downloaded the report, displayed as the author of the report
• Time when the report was generated
The following is an example:
Two tables are dynamically generated in the PCI compliance report to display the status of each PCI requirement. The format of the table is shown in the
example that follows:
The first column describes the PCI requirement.
The second column displays the status of the PCI requirement under current Web Application Firewall settings. There are four possible values for the
status, distinguished by color.
• Satisfied (Green)
• Partially Satisfied (Orange)
• Unsatisfied (Red)
• Unable to determine (Black)
The third column provides comments and details explaining the status rating. If the status is Satisfied, no comments are provided.

How Does Cookie Tampering Protection Work?

SMA/SRA appliances protect important server-side cookies from tampering.
There are two kinds of cookies:
• Server-Side Cookies – These cookies are generated by backend Web servers. They are important and have to be protected. They have optional
attributes like Path, Domain, Secure, and HttpOnly.
• Client-Side Cookies – These cookies are created by client side scripts in user browsers. They are not safe, and can be easily tampered with.
This feature is found on the Web Application Firewall > Settings page.
This page contains the following options:
Portals – A list of all application offloading portals. Each portal has its own settings. The item Global is the default setting for all portals.