Ensure cookies have the secure flag

Docs > Code Analysis > Static Analysis Rules > Ensure cookies have the secure flag

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

ID: csharp-security/cookie-secure-flag

Language: C#

Severity: Warning

Category: Security

Description

Cookies must always have the secure attribute so that they are not sent through an unencrypted HTTP session.

Learn More

CWE-614: Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute

Non-Compliant Code Examples

class MyClass {
    public static void setSecureCookie()
    {
        HttpCookie myCookie = new HttpCookie("my cookie");
        Console.WriteLine("Hello World");
        myCookie.Secure = false;
    }
}

class MyClass {
    public static void setInsecureCookie()
    {
        HttpCookie myCookie = new HttpCookie("my cookie");
        Console.WriteLine("Hello World");
        myCookie.Secure = false;
    }
}