Java : Cookie: reliance without validation

The program’s control flow relies on the values obtained from the cookie. There is no guarantee that the cookies belong to the current user or that they have not been modified.

Attackers can easily modify cookies, within the browser or by implementing the client-side code outside of the browser. Attackers can bypass protection mechanisms such as authorization and authentication by modifying the cookie to contain an expected value.