CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag

How it's found

Sensitive Cookie Without 'HttpOnly' Flag is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.

Vulnerable vs. safe

String sessionID = generateSessionId();Cookie c = new Cookie("session_id", sessionID);response.addCookie(c);

String sessionID = generateSessionId();Cookie c = new Cookie("session_id", sessionID);c.setHttpOnly(true);response.addCookie(c);

Consequences

• Read Application Data: If the HttpOnly flag is not set, then sensitive information stored in the cookie may be exposed to unintended parties.
• Gain Privileges or Assume Identity: If the cookie in question is an authentication cookie, then not setting the HttpOnly flag may allow an adversary to steal authentication data (e.g., a session ID) and assume the identity of the user.

Mitigations

• Implementation: Leverage the HttpOnly flag when setting a sensitive cookie in a response.

How TurboPentest tests for this (white-box)

This weakness (Sensitive Cookie Without 'HttpOnly' Flag) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 10 rules for it, flagging the issue directly in your source code as part of the pentest.

• Insecure Cookie Flags
• Insecure Cookie Flags
• Cookie Secure Httponly Disabled
• Session Cookie Flags Config
• Insecure Cookie Flags
• Insecure Session Cookie Config
• Session Cookie Insecure Params
• Setcookie Not Secure Httponly
• Session Cookie Secure False
• Session Cookie Insecure

Frequently asked questions

Related CWEs

• Class weakness
  CWE-732: Incorrect Permission Assignment for Critical Resource