Symptom:
Starting in Strategy 2019, the Cookies Security Level setting is removed from the Web Administrator Page completely. By default, cookies are enabled and the Store Strategy Intelligence Server sessions information in temporary cookies instead of on the Web server setting is not enabled.
In previous versions of Strategy, the Cookies Security Level setting located on the Web Administrator page and under the Security section could be disabled or enabled as seen below.
The default setting was Enable cookies. When enabled, temporary settings were stored in cookies and lost when a user closed the browser. These settings include the last page visited, filter and template definitions for report execution, shared report location, and so on.
The Cookies Security Level could also be set to Disable cookies. When disabled, no settings were stored in cookies. Instead, Strategy Web stored persistable settings, such as the open and close state of a view filter, in the metadata.
In Strategy 2019, the Disable cookies option was removed as seen below.
With this change, the default behavior for the setting is equivalent to Enable cookies. There is no longer an option to disable cookies.
Answer:
The option to disable cookies was removed to prevent a security threat in Strategy Web 2019 JSP.
When disabling cookies, the JSESSIONID value would appear in the URL followed by a semicolon so that the servlet would retrieve the user session from the URL, rather than the cookie. The Disable cookies setting was removed to ensure the JSESSIONID value is not exposed in the URL.
