SensitiveCookieNotHttpOnly.qhelp

<!DOCTYPE qhelp SYSTEM "qhelp.dtd">
<qhelp>

  <overview>
    <p>Cookies without the <code>HttpOnly</code> flag set are accessible to client-side scripts (such as JavaScript) running in the same origin. 
In case of a Cross-Site Scripting (XSS) vulnerability, the cookie can be stolen by a malicious script.
If a sensitive cookie does not need to be accessed directly by client-side scripts, the <code>HttpOnly</code> flag should be set.</p>
  </overview>

  <recommendation>
    <p>Use the <code>HttpOnly</code> flag when generating a cookie containing sensitive information to help mitigate the risk of client-side scripts accessing the protected cookie.</p>
  </recommendation>

  <example>
    <p>The following example shows two ways of generating sensitive cookies. In the 'BAD' cases, the <code>HttpOnly</code> flag is not set. In the 'GOOD' cases, the <code>HttpOnly</code> flag is set.</p>
    <sample src="SensitiveCookieNotHttpOnly.java" />
  </example>

  <references>
    <li>
      PortSwigger:
      <a href="https://portswigger.net/kb/issues/00500600_cookie-without-httponly-flag-set">Cookie without HttpOnly flag set</a>
    </li>
    <li>
      OWASP:
      <a href="https://owasp.org/www-community/HttpOnly">HttpOnly</a>
    </li>
    <li>MDN: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#httponly">Set-Cookie HttpOnly</a>.</li>
  </references>
</qhelp>