CWE-614
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
AI Translation Available
The Secure attribute for sensitive cookies in HTTPS sessions is not set.
Status
draft
Abstraction
variant
Affected Platforms
Web Based
Technical Details
AI Translation
Common Consequences
confidentiality
Impacts
read application data
Detection Methods
automated static analysis
Potential Mitigations
Phases:
implementation
Descriptions:
•
Always set the secure attribute when the cookie should be sent via HTTPS only.