documentation_complete: true

title: 'Disable Session Cookies'

description: |-
    To disable session only cookies sites, set <tt>CookiesSessionOnlyForUrls</tt>
    to <tt>none</tt> in the Chromium policy file.

rationale: "Cookies should only be allowed per session and only for approved URLs as \npermanently stored cookies can be used for malicious intent."

severity: unknown

identifiers:
    cce: ""

references:
    disa: ""
    nist: ""
    stigid: DTBC0045

ocil_clause: 'it is not disabled'

ocil: |-
    To verify that sessions cookies for approved sites only are enabled,
    run the following command:
    <pre>$ grep CookiesSessionOnlyForUrls /etc/chromium/policies/managed/*.json</pre>
    The output should contain:
    <pre>"CookiesSessionOnlyForUrls": ["none"],</pre>
