Description

Detects when cookies are configured without the 'Secure' flag in C# applications. Cookies without the Secure flag can be transmitted over unencrypted HTTP connections, potentially exposing sensitive cookie data to network eavesdroppers.

Detection Strategy

• Identifies cookie configuration calls using the .Append() method

• Examines the third parameter (options) of the cookie configuration

• Checks if the cookie options lack proper security settings

• Reports a vulnerability when cookie options are found without the Secure flag enabled

Vulnerable code example

using Microsoft.AspNetCore.Http;

public class CookieHelper 
{
    public void SetInsecureCookie(HttpResponse response) 
    {
        var options = new CookieOptions();
        options.Secure = false;  // Vulnerable: Cookie not marked as secure, allowing transmission over HTTP...

✅ Secure code example

using Microsoft.AspNetCore.Http;

public class CookieHelper 
{
    public void SetSecureCookie(HttpResponse response) 
    {
        var options = new CookieOptions
        {...