Insecure cookies
Why is this an issue?
This rule identifies a Security vulnerability where cookies are created without the isSecure flag set to true.
The isSecure parameter (the fifth argument in the Cookie constructor) controls whether a cookie is restricted to HTTPS connections. When set to true, the browser will only send the cookie over HTTPS. When set to false, the cookie can also be sent over unencrypted HTTP connections, where it is vulnerable to interception through man-in-the-middle attacks. Session tokens or other sensitive data in the cookie can be stolen by attackers monitoring HTTP traffic.
Examples
Example of incorrect code: The following code creates a cookie with the isSecure flag set to false.
Cookie sessionCookie = new Cookie(
'SessionId',
sessionValue,
'/',
3600,
false // isSecure is false - vulnerable
);
Example of correct code: The following code creates a secure cookie by setting isSecure to true.
Cookie sessionCookie = new Cookie(
'SessionId',
sessionValue,
'/',
3600,
true // isSecure is true - cookie only sent over HTTPS
);
How can I fix violations?
This rule supports autofix.
To manually fix the violation, change the isSecure parameter (the fifth argument in the Cookie constructor) from false to true. This ensures the cookie is only transmitted over secure HTTPS connections.
When should I disable this rule?
Do not disable this rule for cookies that store session tokens, authentication data, or any user-specific information. You might dismiss a specific violation only if the cookie contains non-sensitive, publicly available information such as a UI preference or page counter.
Resources