logo

Database

Java Missing Secure Cookie Flag Servlet

Description

Identifies when cookies are created without the secure flag in Java Servlet applications. Cookies without the secure flag can be transmitted over unencrypted HTTP connections, potentially exposing sensitive information to attackers who can intercept network traffic.

Weakness:

130 - Insecurely generated cookies - Secure

Category: Access Subversion

Detection Strategy

    • Identifies calls to addCookie() method in Java Servlet code

    • Examines cookie configuration to check if the secure flag is set

    • Reports a vulnerability when a cookie is added without explicitly setting the secure flag to true

    • Focuses on response.addCookie() and similar cookie creation methods

Vulnerable code example

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletResponse;

public void setCookie(HttpServletResponse response) {
    Cookie cookie = new Cookie("sessionId", "abc123");
    cookie.setPath("/");
    cookie.setHttpOnly(true);
    // Vulnerable: Cookie is not marked as secure, allowing transmission over HTTP...

✅ Secure code example

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletResponse;

public void setCookie(HttpServletResponse response) {
    Cookie cookie = new Cookie("sessionId", "abc123");
    cookie.setPath("/");
    cookie.setHttpOnly(true);
    cookie.setSecure(true);  // Required: Ensures cookie is only sent over HTTPS...