DerScanner
Home / Vulnerability Database / Config files : Cookie: not HttpOnly
Config files

Config files : Cookie: not HttpOnly

Classification

OWASP Top 10 2013
A2-Broken Authentication and Session Management
OWASP Mobile Top 10 2016
M2-Insecure Data Storage
OWASP Top 10 2017
A2-Broken AuthenticationA3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic FailuresA4-Insecure DesignA7-Identification and Authentication Failures
OWASP ASVS
Session Management
PCI DSS 4.0
6.2.4
HIPAA
§164.312 (e)(1)
CWE
CWE-732CWE-1004CWE-1028
CWE/SANS Top 25 2011
CWE-732
CWE/SANS Top 25 2021
CWE-732

Overview

The application uses cookies without the property HttpOnly set to true. HttpOnly ensures that cookies are only transferred over HTTP. It protects them from being stolen via JavaScript-code (XSS).

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

References

  1. The ultimate guide to secure cookies with web.config in .NET
  2. Securing Session INI Settings - php.net
  3. OWASP Top 10 2017 A2-Broken Authentication
  4. OWASP Top 10 2013-A5-Security Misconfiguration
  5. Origin Cookies: Session Integrity for Web Applications (pdf)
  6. CWE-1004
  7. CWE CATEGORY: OWASP Top Ten 2017 Category A2 - Broken Authentication
LOW

DerScanner Severity Score

Do you want to fix Config files : Cookie: not HttpOnly in your application?

See also

Config files

Config files : Text4Shell Vulnerability

Config files

Config files : Incorrect directory deletion

Config files

Config files : Code injection