Cookie added without the Secure and HttpOnly flags

ID

vbnet.misconfiguration.insecure_cookie_settings

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Misconfiguration

Language

VB.NET

Description

An insecure cookie configuration was detected. A cookie added without the Secure flag can be sent over plaintext HTTP (interceptable via man-in-the-middle); without HttpOnly it is readable from client-side script (aiding session theft via XSS). A cookie with SameSite=None but no Secure flag is rejected by browsers and, when honoured, is exposed cross-site. Set Secure = True (and HttpOnly = True) on the cookie, and never use SameSite=None without Secure (or enforce both in web.config httpCookies).

Rationale

An insecure cookie configuration was detected. A cookie added without the Secure flag can be sent over plaintext HTTP (interceptable via man-in-the-middle); without HttpOnly it is readable from client-side script (aiding session theft via XSS). A cookie with SameSite=None but no Secure flag is rejected by browsers and, when honoured, is exposed cross-site. Set Secure = True (and HttpOnly = True) on the cookie, and never use SameSite=None without Secure (or enforce both in web.config httpCookies).

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub AddInsecureCookie()
    Dim cookie As HttpCookie = New HttpCookie("UserAddedCookie")
    cookie.Value = "data"
    ' VULNERABLE: Cookie added without the Secure and HttpOnly flags
    Response.Cookies.Add(cookie)
End Sub

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References