Medium severityGoSensitive Data ExposureMEDIUM confidence
Sensitive Data In Cookie
A secret or PII/PHI value is stored in a cookie in cleartext (CWE-312/CWE-315).
Standards mapping
- CWE
- CWE-315: Cleartext Storage of Sensitive Information in a CookieCWE-312: Cleartext Storage of Sensitive Information
- OWASP Top 10
- A02:2021 - Cryptographic Failures
- OWASP ASVS
- V8.3.4 (L2)V8.1.1 (L2)
Vulnerable vs. safe
Flagged by this check
return http.Cookie{Name: "password", Value: password}Passes - the safe pattern
return http.Cookie{Name: "session_id", Value: sid}Why it matters & how to fix it
A secret or PII/PHI value is stored in a cookie in cleartext (CWE-312/CWE-315). Cookies are stored on the client and sent with every request, so raw passwords, card numbers, or health identifiers are exposed to theft (XSS, local access, network capture). Store only an opaque, server-side session identifier; keep sensitive data server-side.
References
Rule ID integsec-go-sensitive-data-in-cookie - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- JavaScript / TypeScript - Sensitive Data ExposureError Stack In Response
- JavaScript / TypeScript - Sensitive Data ExposurePII PHI In Logs
- JavaScript / TypeScript - Sensitive Data ExposureSecret In Logs
- JavaScript / TypeScript - Sensitive Data ExposureSensitive Data Client Storage
- JavaScript / TypeScript - Sensitive Data ExposureSensitive Data In URL Query
- Python - Sensitive Data ExposureFlask Traceback In Response