Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
ID |
scala.cookie.scala_cookie_rule_cookieusage |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Cookie |
Language |
Scala |
Description
The information stored in a custom cookie should not be sensitive or related to the session. In most cases, sensitive data should only be stored in session and referenced by the user’s session cookie.
Rationale
The information stored in a custom cookie should not be sensitive or related to the session. In most cases, sensitive data should only be stored in session and referenced by the user’s session cookie.
The following code illustrates a vulnerable pattern detected by this rule:
class PreferenceReader {
@throws[ServletException]
@throws[IOException]
protected def readAll(request: HttpServletRequest, response: HttpServletResponse): Unit = {
for (preference <- request.getCookies) {
// VULNERABLE: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
preference.getName
// VULNERABLE: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
preference.getValue
// VULNERABLE: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
preference.getPath
}
}
def firstName(request: HttpServletRequest) = {
val first: Cookie = request.getCookies.head
first.getName
}
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A01 : Broken Access Control.