Secure attribute explicitly set to false with CookieBuilder::secure106
107fn use_cookie_builder_without_secure() {
108 Cookie::build("name", "value").secure(true);
109 Cookie::build("name", "value").secure(false);110}
111
112fn use_cookie_without_http_only() {Secure attribute explicitly set to false with Cookie::set_secure101fn use_cookie_without_secure() {
102 let mut c = Cookie::new("name", "value");
103 c.set_secure(true);
104 c.set_secure(false);105}
106
107fn use_cookie_builder_without_secure() {Cookies set without the secure flag can cause the user agent to send those
cookies in plaintext over an HTTP session with the same server. This can lead
to man-in-the-middle
attacks.
In past it has led to the following vulnerabilities:
Generally, the production sites redirect any requests that are sent over HTTP
to the same URL but on HTTPS. In this case, make sure that these HTTP requests
that are immediately redirected to HTTPS do not carry any cookie that contains
sensitive information. The secure flag limits cookies to HTTPS traffic only
so, the browser will never send secure cookies with requests that are not
encrypted.
Bad practice
use cookie::Cookie;
let mut c = Cookie::new("data", "sensitive value")
c.set_secure(false);
Recommended
use cookie::Cookie;
let mut c = Cookie::new("data", "sensitive value")
c.set_secure(true);
References
Cookie::set_secureCookieBuilder::secure- OWASP Top 10:2021 > A02 - Cryptographic Failures
- CWE-314: Missing Encryption of Sensitive Data
- CWE-315: Cleartext Storage of Sensitive Information in a Cookie
- CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Exceptions
While this issue mostly makes sense if you're setting a sensitive cookie,
DeepSource will flag all the cookies encountered without the secure flag.
This is to ensure that every cookie is audited carefully.