Medium severityJavaInsecure ConfigurationMEDIUM confidence
Session Cookie Flags Config
A session cookie flag is disabled in configuration (server.servlet.session.cookie.secure/http-only=false, CWE-614/CWE-1004).
Standards mapping
- CWE
- CWE-614: Sensitive Cookie in HTTPS Session Without Secure AttributeCWE-1004: Sensitive Cookie Without HttpOnly Flag
- OWASP Top 10
- A05:2021 - Security Misconfiguration
- OWASP ASVS
- V3.4.1 (L1)V3.4.2 (L1)
Vulnerable vs. safe
Flagged by this check
// server.servlet.session.cookie.secure=falsePasses - the safe pattern
// server.servlet.session.cookie.secure=trueWhy it matters & how to fix it
A session cookie flag is disabled in configuration (server.servlet.session.cookie.secure/http-only=false, CWE-614/CWE-1004). This exposes the session cookie over plain HTTP or to JavaScript. Set both secure and http-only to true (and configure same-site) for session cookies.
References
Rule ID integsec-java-session-cookie-flags-config - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- JavaScript / TypeScript - Insecure ConfigurationCORS Acao Wildcard Header
- JavaScript / TypeScript - Insecure ConfigurationCORS Wildcard Origin
- JavaScript / TypeScript - Insecure ConfigurationCORS Wildcard With Credentials
- JavaScript / TypeScript - Insecure ConfigurationCSRF Protection Disabled
- JavaScript / TypeScript - Insecure ConfigurationExpress Trust Proxy All
- JavaScript / TypeScript - Insecure ConfigurationExpress X Powered By Enabled