CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Weakness ID: 614 (Weakness Variant)
Status: Draft
Description
Description Summary
The Secure attribute for sensitive cookies in HTTPS sessions is
not set, which could cause the user agent to send those cookies in plaintext
over an HTTP session.
Time of Introduction
Implementation
Demonstrative Examples
Example 1
The snippet of code below, taken from a servlet doPost() method,
sets an accountID cookie (sensitive) without calling
setSecure(true).
A product does not set the Secure attribute for
sensitive cookies in HTTPS sessions, which could cause the user agent to
send those cookies in plaintext over an HTTP session with the
product.
A product does not set the secure flag for the
session cookie in an https session, which can cause the cookie to be sent in
http requests and make it easier for remote attackers to capture this
cookie.
A product does not set the secure flag for the
session cookie in an https session, which can cause the cookie to be sent in
http requests and make it easier for remote attackers to capture this
cookie.
A product does not set the secure flag for a
cookie in an https session, which can cause the cookie to be sent in http
requests and make it easier for remote attackers to capture this
cookie.
Potential Mitigations
Phase
Description
Always set the secure attribute when the cookie should sent via HTTPS
only.
Description
