Http Sensitive Persistent Cookie

Description

This detector identifies HTTP cookies that contain sensitive information but have a max age or an expiration value of more than five minutes.

Weakness:

068 - Insecure session expiration time

Category: Access Subversion

Detection Strategy

    Makes HTTP requests to web application endpoints and examines Set-Cookie headers in responses

    Identifies cookies that appear to contain sensitive data based on naming patterns (session IDs)

    Checks if sensitive cookies have insecure max age or expiration values

    Reports vulnerability when sensitive cookies like user sessions do not expire after 5 minutes