Insecure Cookie Vulnerabilities

Learn how to prevent insecure cookie vulnerabilities with real code examples and best practices. Protect your web applications from cookie-based security threats.

Tools recognizing this:

Opengrep Fortify Checkmarx SonarQube Snyk Semgrep CodeQL

What are Insecure Cookies and How Do They Work?

Insecure cookies are a significant web security vulnerability that occurs when cookies containing sensitive information are transmitted without proper security attributes. When cookies are set without security flags, they become vulnerable to various attacks, including:

• Man-in-the-middle attacks

• Cookie theft through XSS

• Session hijacking

• Cookie sniffing over unsecured networks

• Cross-site request forgery (CSRF)

This guide covers insecure cookie vulnerabilities, examples, prevention methods, and how to implement secure cookies using real-world techniques.

One Simple Insecure Cookie Example

Consider this basic example of setting a cookie:

Cookie cookie = new Cookie("sessionId", sessionValue);
response.addCookie(cookie);

This cookie is vulnerable because it:

- Lacks the Secure flag (can be transmitted over HTTP) - Lacks the HttpOnly flag (can be accessed via JavaScript) - Doesn't specify SameSite attribute (vulnerable to CSRF)

Insecure Cookie Prevention Methods: How to Fix Your Code

The most effective way to fix insecure cookie issues is to set appropriate security attributes when creating cookies. Essential security attributes include:

• Secure flag: Ensures cookies are only transmitted over HTTPS

• HttpOnly flag: Prevents JavaScript access to cookies

• SameSite attribute: Controls how cookies are sent in cross-site requests

• Appropriate expiration time

• Path and domain restrictions

Code Samples

Java

Vulnerable Code

Cookie cookie = new Cookie("sessionId", sessionValue);

Fixed Code

Cookie cookie = new Cookie("sessionId", sessionValue);
cookie.setSecure(true);
cookie.setHttpOnly(true);
cookie.setMaxAge(3600);
cookie.setPath("/");
response.addCookie(cookie);

Fix Explanation

The vulnerable code creates a cookie without any security attributes.The fix adds essential security flags: Secure and HttpOnly.Sets appropriate expiration time and path restrictions.Modern frameworks may also support SameSite attribute configuration.

JavaScript

Vulnerable Code

res.cookie('sessionId', sessionValue);

Fixed Code

res.cookie('sessionId', sessionValue, {
    secure: true,
    httpOnly: true,
    sameSite: 'strict',
    maxAge: 3600000,
    path: '/'
});

Fix Explanation

The vulnerable code sets a cookie without security options.The fix includes all necessary security attributes.Uses secure, httpOnly, and sameSite flags.Sets appropriate maxAge and path restrictions.

Python

Vulnerable Code

response.set_cookie('sessionId', session_value)

Fixed Code

response.set_cookie(
    'sessionId',
    session_value,
    secure=True,
    httponly=True,
    samesite='Strict',
    max_age=3600,
    path='/'
)

Fix Explanation

The vulnerable code sets a cookie without security parameters.The fix adds all necessary security attributes.Includes secure, httponly, and samesite flags.Sets appropriate max_age and path restrictions.

C#

Vulnerable Code

Response.Cookies.Append("sessionId", sessionValue);

Fixed Code

var options = new CookieOptions
{
    Secure = true,
    HttpOnly = true,
    SameSite = SameSiteMode.Strict,
    MaxAge = TimeSpan.FromHours(1),
    Path = "/"
};
Response.Cookies.Append("sessionId", sessionValue, options);

Fix Explanation

The vulnerable code creates a cookie without security options.The fix uses CookieOptions to set security attributes.Includes Secure, HttpOnly, and SameSite flags.Sets appropriate MaxAge and Path restrictions.

PHP

Vulnerable Code

setcookie("sessionId", $sessionValue);

Fixed Code

setcookie(
    "sessionId",
    $sessionValue,
    [
        'expires' => time() + 3600,
        'path' => '/',
        'secure' => true,
        'httponly' => true,
        'samesite' => 'Strict'
    ]
);

Fix Explanation

The vulnerable code sets a cookie without security options.The fix includes an array of security attributes.Sets secure, httponly, and samesite flags.Includes appropriate expiration time and path restrictions.

Ruby

Vulnerable Code

cookies[:session_id] = session_value

Fixed Code

cookies[:session_id] = {
  value: session_value,
  secure: true,
  httponly: true,
  same_site: :strict,
  expires: 1.hour.from_now,
  path: '/'
}

Fix Explanation

The vulnerable code sets a cookie without security options.The fix includes a hash of security attributes.Uses secure, httponly, and same_site flags.Sets appropriate expiration time and path restrictions.

Need more help in preventing Insecure Cookies?

Mobb supports fixing many forms of Insecure Cookie vulnerabilities, and can mitigate your issues in batch.

Start now for free at app.mobb.ai

We'd love your feedback!

We're excited to hear your thoughts and ideas about fixing vulnerabilities.

Book a meeting or Contact us if you have any corrections, questions or suggestions. Start now for free at https://app.mobb.ai