<!DOCTYPE qhelp PUBLIC

"-//Semmle//qhelp//EN"

"qhelp.dtd">

<qhelp>

<overview>

<p>Cookies without the <code>Secure</code> flag set may be transmitted using HTTP instead of HTTPS.

This leaves them vulnerable to being read by a third party attacker. If a sensitive cookie such as a session

key is intercepted this way, it would allow the attacker to perform actions on a user's behalf.</p>

</overview>

<recommendation>

<p>

Set the <code>Secure</code> flag to <code>true</code> to ensure cookies are only transmitted over secure HTTPS connections.

</p>

</recommendation>

<example>

<p>

In the following example, in the case marked BAD, the <code>Secure</code> flag is set to <code>false</code> by default.

In the case marked GOOD, the <code>Secure</code> flag is set to <code>true</code>.

</p>

<sample src="examples/CookieWithoutSecure.go"/>

</example>

<references>

<li>MDN: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie">Set-Cookie</a> Header.</li>

<li>Detectify: <a href="https://support.detectify.com/support/solutions/articles/48001048982-cookie-lack-secure-flag">Cookie lack Secure flag</a>.</li>

<li>PortSwigger: <a href="https://portswigger.net/kb/issues/00500200_tls-cookie-without-secure-flag-set">TLS cookie without secure flag set</a>.</li>

</references>

</qhelp>