logo

Database

Java Cookie Secure Flag False

Description

Detects when Spring Framework's CookieGenerator is configured without the secure flag or with secure=false. Missing or disabled secure flags allow cookies to be transmitted over unencrypted HTTP connections, potentially exposing sensitive session data to network attackers.

Weakness:

130 - Insecurely generated cookies - Secure

Category: Access Subversion

Detection Strategy

    • Identifies instances where CookieGenerator objects are created in Spring applications

    • Reports a vulnerability if setCookieSecure() method is never called on the CookieGenerator instance

    • Reports a vulnerability if setCookieSecure() is called with an explicit 'false' parameter

    • Checks the entire scope where the CookieGenerator is used to determine if secure flag is properly set

Vulnerable code example

import org.springframework.web.util.CookieGenerator;
import javax.servlet.http.HttpServletResponse;

public class InsecureCookieExample {
    public void createInsecureCookie(HttpServletResponse response) {
        CookieGenerator cookieGen = new CookieGenerator();
        cookieGen.setCookieName("sessionId");
        // Vulnerable: Cookie created without secure flag, can be transmitted over HTTP...

✅ Secure code example

import org.springframework.web.util.CookieGenerator;
import javax.servlet.http.HttpServletResponse;

public class SecureCookieExample {
    public void createSecureCookie(HttpServletResponse response) {
        CookieGenerator cookieGen = new CookieGenerator();
        cookieGen.setCookieName("sessionId");
        cookieGen.setCookieSecure(true);     // Ensure cookie is only sent over HTTPS...