{"action":"opened","issue":{"url":"https://api.github.com/repos/h3xstream/find-sec-bugs/issues/86","labels_url":"https://api.github.com/repos/h3xstream/find-sec-bugs/issues/86/labels{/name}","comments_url":"https://api.github.com/repos/h3xstream/find-sec-bugs/issues/86/comments","events_url":"https://api.github.com/repos/h3xstream/find-sec-bugs/issues/86/events","html_url":"https://github.com/h3xstream/find-sec-bugs/issues/86","id":106233757,"number":86,"title":"Insecure cookie","user":{"login":"h3xstream","id":593130,"avatar_url":"https://avatars.githubusercontent.com/u/593130?v=3","gravatar_id":"","url":"https://api.github.com/users/h3xstream","html_url":"https://github.com/h3xstream","followers_url":"https://api.github.com/users/h3xstream/followers","following_url":"https://api.github.com/users/h3xstream/following{/other_user}","gists_url":"https://api.github.com/users/h3xstream/gists{/gist_id}","starred_url":"https://api.github.com/users/h3xstream/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/h3xstream/subscriptions","organizations_url":"https://api.github.com/users/h3xstream/orgs","repos_url":"https://api.github.com/users/h3xstream/repos","events_url":"https://api.github.com/users/h3xstream/events{/privacy}","received_events_url":"https://api.github.com/users/h3xstream/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-09-13T18:56:48Z","updated_at":"2015-09-13T18:56:48Z","closed_at":null,"body":"## Pattern\r\nThe pattern is simple spotted this code..\r\n```\r\nCookie cookie = new Cookie(\"userName\",userName);\r\nresponse.addCookie(cookie);\r\n```\r\n\r\nwhile avoiding this one:\r\n```\r\nCookie cookie = new Cookie(\"userName\",userName);\r\ncookie.setSecure(true);\r\nresponse.addCookie(cookie);\r\n```\r\n\r\n## Precision\r\n\r\nThis is a detector idea was previously skipped because it can be handle by web container rather than application. We can still create the detector to please the [Benchmark project](https://www.owasp.org/index.php/Benchmark) and possibly some security auditors. If this is handle by the container then it can easily be ignored by auditor.\r\n\r\nA much better approach would be to add a configuration to the web container or the `web.xml` to avoid manual configuration.\r\n```\r\n<web-app xmlns=\"http://java.sun.com/xml/ns/javaee\" version=\"3.0\">\r\n[...]\r\n<session-config>\r\n <cookie-config>\r\n  <http-only>true</http-only>\r\n  <secure>true</secure>\r\n </cookie-config>\r\n</session-config>\r\n</web-app>\r\n```"}}