Sep 17 2026

V5341. A cookie was created without enabling the 'Secure' attribute. This may lead to the exposure of sensitive data.

Sep 17 2026

The analyzer has detected a cookie created without the Secure attribute.

This potential vulnerability can be categorized under the OWASP Top 10 as follows:

The example:

public void servletExample(
  HttpServletRequest request, 
  HttpServletResponse response
) {
    Cookie cookie = new Cookie("name", getCookieValue());
    cookie.setSecure(false);
    response.addCookie(cookie);
    ....
}

The cookie object is created and included in the server's response. After the cookie is created, the Cookie#setSecure method is called with false, explicitly indicating that the Secure attribute should not be set for the cookie being created.

If the Secure attribute is not set in a cookie header, that cookie object will be sent from the browser to the server via both HTTPS and the unsecured HTTP protocol. As a result, sensitive data from the cookie will be passed in cleartext, and attackers who intercept an unencrypted request can extract the sensitive data without decryption.

To prevent the browser from sending cookies over the unsecured HTTP protocol, set the appropriate attribute when creating the Cookie object:

public void servletSecureExample(
  HttpServletRequest request, 
  HttpServletResponse response
) {
    Cookie cookie = new Cookie("name", getCookieValue());
    cookie.setSecure(true);
    response.addCookie(cookie);
    ....
}

In this case, the cookie header contains the Secure attribute, which indicates to the browser that the cookie can only be sent over the HTTPS protocol.

It's also recommended to consider the various APIs used to create Cookie objects. Most of these APIs do not set the Secure attribute by default when an object is created.

The examples of insecure cookies:

public void insecureCookie(
  HttpServletRequest request, 
  HttpServletResponse response
) {
    Cookie cookie = new Cookie("name", getCookieValue());
    response.addCookie(cookie);
    ....
}

public void insecureResponseCookie(
  HttpServletRequest request, 
  HttpServletResponse response
) {
    ResponseCookie cookie = ResponseCookie
                 .from("name", getCookieValue())
                 .build();
    response.addHeader(HttpHeaders.SET_COOKIE, cookie.toString());
    ....
}

Was this page helpful?