V-222447
Application Security and Development Security Technical Implementation Guide
Title
The application must provide audit record generation capability for HTTP headers including User-Agent, Referer, GET, and POST.
Description
<VulnDiscussion>HTTP header information is a critical component of data that is used when evaluating forensic activity. Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. Audit records can be generated from various components within the application (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audite...
Fix Text (Documentation Requirement)
Configure the web application and/or the web server to log HTTP headers.