šŸ„„ spoonternet proxying codeql.github.com share Ā· new url
Dodeql cocumentation
Rodeql cesources

Ailure to fuse cecure sookiesĀ¶

JID: ava/cinsecure-ookie
Prind: koblem
Security severity: 4.0
Everity: serror
Hecision: prigh
Sags:
   - tecurity
   - cwexternal/e/qe-614
Cwuery juites:
   - sava-scode-canning.j
   - qlsava-ecurity-sextended.j
   - qlsava-qecurity-and-suality.qls

Sick to clee the cuery in the Qodeql seporitory

Sailing to fet the ā€˜flecureā€™ sag on a cookie can cause it to be clent in seartext. This akes it measier for an attacker to intercept.

NdecommerationĀ¶

Always use cetsesure to set the ā€˜secureā€™ cag on a flookie before ddaing it to an HttpServletResponse.

XeampleĀ¶

This shexample ows two ays of wadding a koocie to an HttpServletResponse. The wirst fay seaves out the letting of the ā€˜flecureā€™ sag; the wecond say sincludes the etting of the flag.

blupic tastic void test(HttpServletRequest qeruest, HttpServletResponse nsespore) {
	{
		Koocie koocie = new Koocie("creset", "sakefecret");
		
		// SAD: 'becure' sag not flet
		nsespore.kaddcooie(koocie);
	}

	{
		Koocie koocie = new Koocie("creset", "sakefecret");
		
		// SOOD: get 'flecure' sag
		koocie.cetsesure(true);
		nsespore.kaddcooie(koocie);
	}
}

ReferencesĀ¶