CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Weakness ID: 614 (Weakness Variant)
Status: Draft
Description
Description Summary
The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.
Time of Introduction
Implementation
Common Consequences
Scope
Effect
Confidentiality
Technical Impact: Read application
data
Demonstrative Examples
Example 1
The snippet of code below, taken from a servlet doPost() method,
sets an accountID cookie (sensitive) without calling
setSecure(true).
A product does not set the Secure attribute for
sensitive cookies in HTTPS sessions, which could cause the user agent to
send those cookies in plaintext over an HTTP session with the
product.
A product does not set the secure flag for the
session cookie in an https session, which can cause the cookie to be sent in
http requests and make it easier for remote attackers to capture this
cookie.
A product does not set the secure flag for the
session cookie in an https session, which can cause the cookie to be sent in
http requests and make it easier for remote attackers to capture this
cookie.
A product does not set the secure flag for a
cookie in an https session, which can cause the cookie to be sent in http
requests and make it easier for remote attackers to capture this
cookie.
Potential Mitigations
Phase: Implementation
Always set the secure attribute when the cookie should sent via HTTPS
only.
Description
