Ensure cookies have the secure flag

Docs > Code Analysis > Static Analysis Rules > Ensure cookies have the secure flag

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: csharp-security/cookie-secure-flag

Language: C#

Severity: Warning

Category: Security

CWE: 614

Description

Cookies must always have the secure attribute so that they are not sent through an unencrypted HTTP session.

Learn More

CWE-614: Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute

Non-Compliant Code Examples

class MyClass {
    public static void setSecureCookie()
    {
        HttpCookie myCookie = new HttpCookie("my cookie");
        Console.WriteLine("Hello World");
        myCookie.Secure = false;
    }
}

class MyClass {
    public static void setInsecureCookie()
    {
        HttpCookie myCookie = new HttpCookie("my cookie");
        Console.WriteLine("Hello World");
        myCookie.Secure = false;
    }
}