What is Sensitive Cookie in HTTPS Session (CWE-614)?

TL;DR: Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute (CWE-614) is a security misconfiguration where sensitive cookies lack the Secure attribute, making them vulnerable to interception and exposure. Ensure that sensitive cookies always have the Secure flag set.

What is Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute?

Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute (CWE-614) is a type of security misconfiguration vulnerability that occurs when sensitive cookies are transmitted over HTTP without the Secure attribute. As defined by the MITRE Corporation under CWE-614, and classified by the OWASP Foundation under A02:2025 - Security Misconfiguration…

Quick Summary

Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute is a serious security misconfiguration that can lead to data exposure and session hijacking. It occurs when sensitive cookies are transmitted over HTTP without the Secure attribute, making them vulnerable to interception by attackers.

Jump to: Quick Summary · Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute Overview · How Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute Works · Business Impact of Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute · Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute Attack Scenario · How to Detect Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute · How to Fix Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute · Framework-Specific Fixes for Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute · How to Ask AI to Check Your Code for Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute · Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute Best Practices Checklist · Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute FAQ · Vulnerabilities Related to Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute · References · Scan Your Own Site

Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute Overview

What

Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute is a security misconfiguration where sensitive cookies are transmitted over HTTP without the Secure attribute.

Why it matters

Without the Secure flag, sensitive cookies can be intercepted and read by attackers when transmitted over unencrypted HTTP connections. This leads to data exposure and session hijacking risks.

Where it occurs

This vulnerability commonly affects web applications that handle user sessions or authentication tokens via cookies.

Who is affected

Web application users whose sensitive information (e.g., session IDs, login credentials) can be intercepted by attackers due to missing Secure attributes on their cookies.

Who is NOT affected

Users of applications where all sensitive cookies are properly marked with the Secure attribute and transmitted only over HTTPS connections.

How Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute Works

Root Cause

The root cause is the absence of the Secure attribute for sensitive cookies, which allows them to be sent over HTTP instead of HTTPS.

Attack Flow

1. An attacker intercepts unencrypted HTTP traffic.
2. The attacker captures sensitive cookie data transmitted without the Secure flag.
3. The attacker uses captured session IDs or authentication tokens to hijack user sessions.

Prerequisites to Exploit

• The application must transmit sensitive cookies over HTTP connections.
• Users must access the site via an insecure network (e.g., public Wi-Fi).

Vulnerable Code

response.set_cookie('session_id', 'abc123')

This code sets a session cookie without specifying the Secure attribute, making it vulnerable to interception.

Secure Code

response.set_cookie('session_id', 'abc123', secure=True)

Setting the secure parameter ensures that the cookie is only transmitted over HTTPS connections, preventing exposure via HTTP.

Business Impact of Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute

Confidentiality

• Data Exposure: Attackers can intercept and read sensitive cookies containing session IDs or authentication tokens.
• Session Hijacking: Captured session data allows attackers to impersonate users and gain unauthorized access.

Integrity

• No direct impact on integrity, but compromised sessions can lead to unauthorized actions being performed in the user’s name.

Availability

• No direct impact on availability, but compromised sessions may disrupt normal service if attackers misuse them.

Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute Attack Scenario

1. An attacker intercepts HTTP traffic from a victim accessing an insecure website.
2. The attacker captures session cookies transmitted without the Secure attribute.
3. Using captured session IDs, the attacker logs into the user’s account and performs unauthorized actions.

How to Detect Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute

Manual Testing

• Check HTTP responses for cookie attributes using browser developer tools or network sniffing software.
• Verify that sensitive cookies have the Secure attribute set.

Automated Scanners (SAST / DAST)

• Static analysis can detect missing Secure attributes in configuration files and code.
• Dynamic testing involves intercepting HTTP traffic to identify unsecured cookie transmissions.

PenScan Detection

PenScan’s scanner engines like ZAP, Nuclei, Wapiti, Nikto, SSLyze, Dalfox, and Nmap can help detect this vulnerability by analyzing HTTP responses for missing Secure attributes on sensitive cookies.

False Positive Guidance

False positives may occur if the application is designed to work only over HTTPS and does not transmit any sensitive data via HTTP. Ensure that all traffic involving sensitive information is indeed unencrypted before flagging a false positive.

How to Fix Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute

• Always set the Secure attribute when defining sensitive cookies.
• Review existing cookie configurations to ensure they are properly marked with the Secure attribute.
• Implement security policies and guidelines to enforce proper use of the Secure attribute for all sensitive cookies.

Framework-Specific Fixes for Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute

Java

Cookie sessionCookie = new Cookie("session_id", "abc123");
response.addCookie(sessionCookie);
sessionCookie.setSecure(true);

Node.js

res.cookie('session_id', 'abc123', { secure: true });

Python/Django

response.set_cookie('session_id', 'abc123', secure=True)

PHP

setcookie("session_id", "abc123", 0, "/", "", true, true);

How to Ask AI to Check Your Code for Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute

Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute Best Practices Checklist

✅ Always set the Secure attribute when defining sensitive cookies. ✅ Review existing cookie configurations to ensure proper use of the Secure flag. ✅ Implement security policies and guidelines for enforcing Secure attribute usage. ✅ Test your application thoroughly to detect missing Secure attributes on sensitive cookies.

Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute FAQ

How does the Secure attribute protect sensitive cookies?

The Secure attribute ensures that a cookie is only transmitted over an encrypted HTTPS connection, preventing it from being sent in plaintext.

What happens if the Secure flag is missing for sensitive cookies?

Without the Secure flag, sensitive cookies can be intercepted and read by attackers when transmitted over HTTP connections.

Can you provide a real-world example of this vulnerability?

A web application that sets session cookies without the Secure attribute could expose user sessions to interception on unsecured networks or via man-in-the-middle attacks.

How do I detect Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute?

Use automated scanners like ZAP and manual testing techniques such as reviewing HTTP responses for cookie attributes.

What is the best way to fix this vulnerability?

Always set the Secure attribute when defining sensitive cookies to ensure they are only transmitted over secure connections.

How can I prevent Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute using OWASP guidelines?

Follow security configuration guidelines and ensure all sensitive cookies have the Secure flag enabled.

What are some common mistakes when fixing this issue?

Failing to review existing cookie configurations or incorrectly setting other attributes like HttpOnly can leave vulnerabilities unaddressed.

Vulnerabilities Related to Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute

References

• MITRE
• OWASP Security Misconfiguration
• CAPEC-102
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute and other risks before an attacker does.