Description
The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
Potential Impact
- Confidentiality: Read Application Data
- Integrity: Gain Privileges or Assume Identity
How to Fix
Implementation
Leverage the HttpOnly flag when setting a sensitive cookie in a response.
Detection Methods
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin...
Related Weaknesses
References
View on MITRE CWE Database →
