Security Test: Frontend Cookie Security¶

Scanner(s) Support¶

Description¶

Default Severity: low

When cookies aren't set to only be shared over encrypted connections or restricted from being accessed by scripts, attackers can grab these cookies and use them to impersonate users. This flaw occurs when developers don't include proper settings—like flags that prevent JavaScript access or ensure cookies are sent only over secure channels. If left unchecked, attackers can hijack sessions or steal sensitive data, leading to unauthorized access and other security issues.

Reference:

• https://owasp.org/www-community/Security_Headers
  • https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-content-caching
  • https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes.html

Configuration¶

Identifier: frontend_protocol/header_set_cookie

Examples¶

All configuration available:

checks:
  frontend_protocol/header_set_cookie:
    skip: false # default

Compliance and Standards¶