Detections
Analytics
Web Application Session Cookies Not Marked Secure
medium Nessus Plugin ID 49218
Language:
Synopsis
HTTP session cookies may be transmitted in cleartext.Description
The remote web application uses cookies to track authenticated users. However, there are instances where the application is running over unencrypted HTTP or the cookie(s) are not marked 'secure', meaning the browser could send them back over an unencrypted link under certain circumstances.As a result, it may be possible for a remote attacker to intercept these cookies.
Solution
- Host the web application on a server that only provides SSL (HTTPS).- Mark all cookies as 'secure'.