Sensitive Cookie Without 'HttpOnly' Flag
ID |
scala.cookie.scala_cookie_rule_cookiehttponly |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Cookie |
Language |
Scala |
Description
A new cookie is created without the HttpOnly flag set. The HttpOnly flag is a directive to the browser to make sure that the cookie can not be red by malicious script. When a user is the target of a "Cross-Site Scripting", the attacker would benefit greatly from getting the session id for example.
Rationale
A new cookie is created without the HttpOnly flag set. The HttpOnly flag is a directive to the browser to make sure that the cookie can not be red by malicious script. When a user is the target of a "Cross-Site Scripting", the attacker would benefit greatly from getting the session id for example.
The following code illustrates a vulnerable pattern detected by this rule:
class SessionCookieWriter {
def writeOptedOut(response: HttpServletResponse): Unit = {
// VULNERABLE: Sensitive Cookie Without 'HttpOnly' Flag
val session = new Cookie("sid", "a41f9c")
session.setSecure(true)
session.setMaxAge(900)
session.setHttpOnly(false)
response.addCookie(session)
}
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A01 : Broken Access Control.