What it is: Use of Persistent Cookies Containing Sensitive Information (CWE-539) is a type of vulnerability where sensitive information is stored in persistent cookies.
Why it matters: This can lead to unauthorized access and data breaches, compromising user privacy and security.
How to fix it: Do not store sensitive information in persistent cookies.
TL;DR: Use of Persistent Cookies Containing Sensitive Information (CWE-539) is a vulnerability where web applications store sensitive data in persistent cookies, leading to potential security breaches. To mitigate this issue, avoid storing sensitive information in such cookies.
| Field | Value |
|---|---|
| CWE ID | CWE-539 |
| OWASP Category | A06:2025 - Insecure Design |
| CAPEC | CAPEC-21, CAPEC-31, CAPEC-39, CAPEC-59, CAPEC-60 |
| Typical Severity | High |
| Affected Technologies | web applications, web browsers |
| Detection Difficulty | Moderate |
| Last Updated | 2026-07-29 |
What is Use of Persistent Cookies Containing Sensitive Information?
Use of Persistent Cookies Containing Sensitive Information (CWE-539) is a type of vulnerability that occurs when sensitive information, such as passwords or tokens, is stored in persistent cookies within web applications. As defined by the MITRE Corporation under CWE-539 and classified by the OWASP Foundation under A06:2025 - Insecure Design.
Quick Summary
Use of Persistent Cookies Containing Sensitive Information can lead to significant security risks such as unauthorized access, data breaches, and privacy violations. This vulnerability is critical because it exposes sensitive information that could be intercepted or stolen by attackers. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixes
Jump to: Quick Summary · Use of Persistent Cookies Containing Sensitive Information Overview · How Use of Persistent Cookies Containing Sensitive Information Works · Business Impact of Use of Persistent Cookies Containing Sensitive Information · Use of Persistent Cookies Containing Sensitive Information Attack Scenario · How to Detect Use of Persistent Cookies Containing Sensitive Information · How to Fix Use of Persistent Cookies Containing Sensitive Information · Framework-Specific Fixes for Use of Persistent Cookies Containing Sensitive Information · How to Ask AI to Check Your Code for Use of Persistent Cookies Containing Sensitive Information · Use of Persistent Cookies Containing Sensitive Information Best Practices Checklist · Use of Persistent Cookies Containing Sensitive Information FAQ · Vulnerabilities Related to Use of Persistent Cookies Containing Sensitive Information · References · Scan Your Own Site
Use of Persistent Cookies Containing Sensitive Information Overview
What
Use of Persistent Cookies Containing Sensitive Information is a vulnerability where sensitive information is stored in persistent cookies.
Why it matters
Storing sensitive data in persistent cookies can lead to unauthorized access, data breaches, and privacy violations. Attackers may exploit this by stealing or intercepting the cookie contents.
Where it occurs
This issue commonly occurs in web applications that use persistent cookies without proper security measures.
Who is affected
Web application users whose credentials or sensitive information are stored in persistent cookies can be at risk of data exposure.
Who is NOT affected
Applications that do not store sensitive information in persistent cookies and instead use session-based storage mechanisms are less likely to be vulnerable.
How Use of Persistent Cookies Containing Sensitive Information Works
Root Cause
The root cause lies in the improper handling of sensitive data within persistent cookies, making it accessible to external parties.
Attack Flow
- An attacker intercepts or steals a persistent cookie containing sensitive information.
- The stolen cookie is used to gain unauthorized access to user accounts or resources.
Prerequisites to Exploit
- Persistent cookies must contain sensitive information.
- Cookies should not have the “secure” flag set, allowing them to be transmitted over HTTP.
Vulnerable Code
def set_cookie(request):
# Storing sensitive data in a persistent cookie
response.set_cookie('user_token', request.form['token'], max_age=3600)
This code stores user credentials or tokens directly in a persistent cookie, which can be intercepted.
Secure Code
def set_secure_cookie(request):
# Use session-based storage instead of cookies for sensitive data
session['user_token'] = request.form['token']
The secure version avoids storing sensitive information in persistent cookies and uses session-based mechanisms to handle such data securely.
Business Impact of Use of Persistent Cookies Containing Sensitive Information
Confidentiality
Sensitive user data can be exposed, leading to unauthorized access and potential misuse of credentials or personal details.
Integrity
No direct impact on integrity as this vulnerability primarily affects confidentiality. However, exposure could indirectly affect system integrity if attackers use stolen cookies for malicious activities.
Use of Persistent Cookies Containing Sensitive Information Attack Scenario
- An attacker intercepts a persistent cookie containing sensitive information.
- The attacker uses the intercepted cookie to gain unauthorized access to user accounts or resources within the web application.
How to Detect Use of Persistent Cookies Containing Sensitive Information
Manual Testing
- Review cookie settings and ensure no sensitive information is stored persistently.
- Check if any cookies have the “secure” flag set to true.
Automated Scanners (SAST / DAST)
Static analysis can detect persistent cookies containing sensitive data, while dynamic testing can confirm whether such cookies are transmitted over insecure channels.
PenScan Detection
PenScan’s automated scanners actively test for this issue using tools like ZAP and Wapiti.
False Positive Guidance
False positives may occur if the cookie contains non-sensitive information or is marked as “secure” with HTTPS enforcement. Ensure that sensitive data is not stored in persistent cookies to avoid false alarms.
How to Fix Use of Persistent Cookies Containing Sensitive Information
- Do not store sensitive information in persistent cookies.
- Use session-based storage mechanisms instead for handling sensitive user data.
Framework-Specific Fixes for Use of Persistent Cookies Containing Sensitive Information
Python/Django
def set_secure_cookie(request):
# Store sensitive data securely using sessions
request.session['user_token'] = request.form['token']
This example shows how to use Django’s session mechanism to handle sensitive user information securely.
How to Ask AI to Check Your Code for Use of Persistent Cookies Containing Sensitive Information
Review the following Python code block for potential CWE-539 Use of Persistent Cookies Containing Sensitive Information vulnerabilities and rewrite it using session-based storage: [paste code here]
Use of Persistent Cookies Containing Sensitive Information Best Practices Checklist
✅ Do not store sensitive information in persistent cookies. ✅ Use secure methods like session-based storage to handle sensitive user data. ✅ Ensure cookies have the “secure” flag set and are transmitted over HTTPS.
Use of Persistent Cookies Containing Sensitive Information FAQ
How can I prevent the use of persistent cookies containing sensitive information?
Do not store sensitive information in persistent cookies. Instead, consider using session-based storage or other secure methods to handle sensitive data.
What are the consequences if an attacker gains access to a cookie with sensitive information?
An attacker can read application data and potentially use it for unauthorized activities such as impersonation or financial fraud.
How does Use of Persistent Cookies Containing Sensitive Information work in web applications?
Web applications store sensitive information like passwords, tokens, or personal details in persistent cookies that are accessible to external parties.
What is the root cause of this vulnerability?
The root cause lies in storing sensitive data within persistent cookies without proper security measures.
How can I detect Use of Persistent Cookies Containing Sensitive Information manually?
Review cookie settings and ensure no sensitive information is stored persistently. Check if any cookies have the “secure” flag set to true.
What are some common attack patterns associated with this vulnerability?
Attackers may exploit persistent cookies by stealing them through XSS attacks or by intercepting network traffic.
How can I fix Use of Persistent Cookies Containing Sensitive Information in my application?
Remove sensitive information from persistent cookies and use secure methods like session-based storage to handle such data.
Vulnerabilities Related to Use of Persistent Cookies Containing Sensitive Information
| CWE | Name | Relationship |
|---|---|---|
| CWE-552 | Files or Directories Accessible to External Parties (ChildOf) |
References
- MITRE - CWE-539
- OWASP Top 10: A06:2025 - Insecure Design
- CAPEC-21, CAPEC-31, CAPEC-39, CAPEC-59, CAPEC-60
- NVD - National Vulnerability Database
Scan Your Own Site
Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Use of Persistent Cookies Containing Sensitive Information and other risks before an attacker does.