Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Missing `secure: true` on Phoenix session cookie or remember-me cookie options. Cookies sent over unencrypted HTTP can be intercepted by an active network attacker. Ensure production configurations set `secure: true`.
The `Secure` attribute when set to `true` protects the cookie value from being being transmitted over clear text communication paths such as HTTP. By enabling this protection, the cookie will only be sent over HTTPS. Example of protecting a `Cookie`: ``` // Create an Secure cookie. Cookie someCookie = new Cookie("SomeCookieName", "SomeValue"); // Set Secure
JavaCWE-614"A new cookie is created without the Secure flag set. The Secure flag is a directive to the browser to make sure that the cookie is not sent for insecure communication (http://)"
KotlinCWE-614"Storing sensitive data in a persistent cookie for an extended period can lead to a breach of confidentiality or account compromise."
ScalaCWE-614'Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS.'
JSCWE-614The information stored in a custom cookie should not be sensitive or related to the session. In most cases, sensitive data should only be stored in session and referenced by the user's session cookie.
ScalaCWE-614The `Secure` attribute when set to `true` protects the cookie value from being being transmitted over clear text communication paths such as HTTP. By enabling this protection, the cookie will only be sent over HTTPS. Example of protecting an HttpCookie: ``` // Create an HttpOnly cookie. HttpCookie someCookie = new HttpCookie("SomeCookieName", "SomeValue"); s
C#CWE-614
