CWE-1004Sensitive Cookie Without 'HttpOnly' Flag

Description

Common consequences· 2

• Confidentiality — Read Application Data
  If the HttpOnly flag is not set, then sensitive information stored in the cookie may be exposed to unintended parties.
• Integrity — Gain Privileges or Assume Identity
  If the cookie in question is an authentication cookie, then not setting the HttpOnly flag may allow an adversary to steal authentication data (e.g., a session ID) and assume the identity of the user.

Potential mitigations· 1

• [Implementation]Leverage the HttpOnly flag when setting a sensitive cookie in a response.

Compliance frameworks addressing this (incoming)2

(incoming)4

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.