Description

Detects Rust web applications using Actix that create cookies without the secure flag set. Cookies without the secure flag can be transmitted over unencrypted HTTP connections, making them vulnerable to interception by attackers. This exposes session tokens and sensitive data to network-based attacks.

Detection Strategy

• Identifies Actix web framework cookie creation methods in Rust code

• Checks if cookies are created without calling .secure(true) method or cookie_secure function

• Reports vulnerability when cookie objects are instantiated or configured without proper secure flag settings

• Focuses on session management code where cookies are being established or modified

Vulnerable code example

use actix_web::cookie::Cookie;
use actix_web::{HttpResponse, Responder};

async fn login(token: String) -> impl Responder {
    // VULNERABLE: session cookie missing .secure(true) - sent over plain HTTP
    HttpResponse::Ok()
        .cookie(Cookie::build("session_id", token).finish())
        .finish()...

✅ Secure code example

use actix_web::cookie::Cookie;
use actix_web::{HttpResponse, Responder};

async fn login(token: String) -> impl Responder {
    // SECURE: session cookie has secure(true) - only sent over HTTPS
    HttpResponse::Ok()
        .cookie(Cookie::build("session_id", token).secure(true).http_only(true).finish())
        .finish()...