Sensitive server cookie exposed to the client — CodeQL query help documentation
CodeQL docs
Sensitive server cookie exposed to the client
ID: js/client-exposed-cookie
Kind: problem
Security severity: 5.0
Severity: warning
Precision: high
Tags:
- security
- external/cwe/cwe-1004
Query suites:
- javascript-code-scanning.qls
- javascript-security-extended.qls
- javascript-security-and-quality.qls
Click to see the query in the CodeQL repository
Authentication cookies stored by a server can be accessed by a client if the httpOnly flag is not set.
An attacker that manages a cross-site scripting (XSS) attack can read the cookie and hijack the session.
Recommendation
Set the httpOnly flag on all cookies that are not needed by the client.
Example
The following example stores an authentication token in a cookie that can be viewed by the client.
const http = require('http');
const server = http.createServer((req, res) => {
res.setHeader("Set-Cookie", `authKey=${makeAuthkey()}`);
res.writeHead(200, { 'Content-Type': 'text/html' });
res.end('<h2>Hello world</h2>');
});
To force the cookie to be transmitted using SSL, set the secure attribute on the cookie.
const http = require('http');
const server = http.createServer((req, res) => {
res.setHeader("Set-Cookie", `authKey=${makeAuthkey()}; secure; httpOnly`);
res.writeHead(200, { 'Content-Type': 'text/html' });
res.end('<h2>Hello world</h2>');
});
References