CWE-614Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Description

The Secure attribute for sensitive cookies in HTTPS sessions is not set.

Common consequences

• Confidentiality→Read Application Data
  Omitting the secure flag makes it possible for the user agent to send the cookies in plaintext over an HTTP session.

Potential mitigations

• Implementation
  Always set the secure attribute when the cookie should be sent via HTTPS only.

Related CWEs

Recent CVEs classified under this CWE