Information Exposure Through Persistent Cookies
ID |
scala.cookie.scala_cookie_rule_cookieinsecure |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Cookie |
Language |
Scala |
Description
A new cookie is created without the Secure flag set. The Secure flag is a directive to the browser to make sure that the cookie is not sent for insecure communication (http://)
Rationale
A new cookie is created without the Secure flag set. The Secure flag is a directive to the browser to make sure that the cookie is not sent for insecure communication (http://)
The following code illustrates a vulnerable pattern detected by this rule:
class CheckoutCookieWriter {
def writeOptedOut(response: HttpServletResponse): Unit = {
// VULNERABLE: Information Exposure Through Persistent Cookies
val basket = new Cookie("basket", "7b21e0")
basket.setHttpOnly(true)
basket.setMaxAge(1800)
// VULNERABLE: Information Exposure Through Persistent Cookies
basket.setSecure(false)
response.addCookie(basket)
}
def writeProtected(response: HttpServletResponse): Unit = {
val consent = new Cookie("consent", "granted")
consent.setHttpOnly(true)
consent.setMaxAge(1800)
consent.setSecure(true)
response.addCookie(consent)
}
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A01 : Broken Access Control.