Http Sensitive Persistent Cookie
Description
This detector identifies HTTP cookies that contain sensitive information but have a max age or an expiration value of more than five minutes.
Detection Strategy
• Makes HTTP requests to web application endpoints and examines Set-Cookie headers in responses
• Identifies cookies that appear to contain sensitive data based on naming patterns (session IDs)
• Checks if sensitive cookies have insecure max age or expiration values
• Reports vulnerability when sensitive cookies like user sessions do not expire after 5 minutes
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' pentesting team, fill out this contact form.