org.sonar.l10n.java.rules.squid.S2092.html Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of java-checks Show documentation

There is a newer version: 8.6.0.37351

The "secure" attribute prevents cookies from being sent over plaintext connections such as HTTP, where they would be easily eavesdropped upon. Instead, cookies with the secure attribute are only sent over encrypted HTTPS connections.
Noncompliant Code Example

Cookie c = new Cookie(SECRET, secret);  // Noncompliant; cookie is not secure
response.addCookie(c);

Compliant Solution

Cookie c = new Cookie(SECRET, secret);
c.setSecure(true);
response.addCookie(c);

See


 MITRE, CWE-614 - Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
 OWASP Top Ten 2013 Category A2 - Broken Authentication and Session Management
 OWASP Top Ten 2013 Category A6 - Sensitive Data Exposure