CWE-1004
Sensitive Cookie Without 'HttpOnly' Flag
AI Translation Available
The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
Status
incomplete
Abstraction
variant
Likelihood
medium
Affected Platforms
Web Based
Web Server
Technical Details
AI Translation
Common Consequences
confidentiality
integrity
Impacts
read application data
gain privileges or assume identity
Detection Methods
automated static analysis
Potential Mitigations
Phases:
implementation
Descriptions:
•
Leverage the HttpOnly flag when setting a sensitive cookie in a response.