__Host-Prefix wrong

[eason]

Hardenings

Rating A
X __Host-Prefix
The __Host prefix mitigates cookie injection vulnerabilities within potential third-party software sharing the same second level domain. It is an additional hardening on top of ‘normal’ same-site cookies.

HI I tried the method in the forum, the error is also displayed, and there is only A but not A+, does anyone have a better suggestion?

like this:
1.
vi “/var/www/nextcloud/config/config.php”
‘overwriteprotocol’ => ‘https’,
2.
vi /etc/apache2/sites-available/000-default.conf
Header edit Set-Cookie ^(.*)$ “$1;HttpOnly;Secure;SameSite=Strict”

Running Nextcloud 25.0.3.2

Latest patch level

Major version still supported

Scanned at 2023-02-06 07:30:27

[tflidd]

There are two conditions:

Security: __Host-Prefix cookie setting?

Hey there This one should be applied automatically if the following conditions are met: Nextcloud is accessible via HTTPS Nextcloud is not installed in a subfolder (e.g. cloud.foo.com not cloud.foo.com/nextcloud/) Note that this is only a “hardening” but not a security vulnerability per se. So if you don’t manage to have it: It won’t make your data insecure, but having it is an easy small security gain Can you check if those conditions are met for you? If yes and the setting …

[eason]

OK， it seems that the cause of this error is because my folder is
“/var/www/nextcloud/”
not
“var/www/”

I saw " this is only a “hardening” but not a security vulnerability per se"
So…Ok, let it continue to Rating A
Thanks you.

[tflidd]

The test, and also the messages in the admin interface, they are not always hard error messages where something is really broken, often these are warnings and tips what you can do better but it doesn’t apply in all cases.