Detections
Analytics

1.96 (L1) Ensure 'Enable globally scoped HTTP auth cache' is set to 'Disabled'

Information

This policy setting controls whether HTTP auth credentials may be automatically used in the context of another web site visited in Microsoft Edge.

The recommended state for this setting is: Disabled.

Note: This policy is intended to give enterprises a chance to update their login procedures and will be removed in the future.

Allowing HTTP auth credentials to be shared without the user's consent could lead to a user sharing sensitive information without their knowledge. Enabling this setting could also lead to some types of cross-site attacks, that would allow users to be tracked across sites without the use of cookies.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Disabled :

Microsoft Edge\Enable globally scoped HTTP auth cache

Impact:

None - this is the default behavior.

See Also

https://workbench.cisecurity.org/benchmarks/24642

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Windows

Control ID: 2cf5951b1a7e808ff97da65e75a18faa5c206ce7b8e9052b1cec0f742f2710d3