# V5341\. A cookie was created without enabling the 'Secure' attribute\. This may lead to the exposure of sensitive data\.

The analyzer has detected a cookie created without the Secure attribute\. 

This potential vulnerability can be categorized under the OWASP Top 10 as follows:

* [A05:2021 — Security Misconfiguration](https://owasp.org/Top10/2021/A05_2021-Security_Misconfiguration/);
* [A02:2025 — Security Misconfiguration](https://owasp.org/Top10/2025/A02_2025-Security_Misconfiguration/)\.

The example:

```cpp
public void servletExample(
  HttpServletRequest request, 
  HttpServletResponse response
) {
    Cookie cookie = new Cookie("name", getCookieValue());
    cookie.setSecure(false);
    response.addCookie(cookie);
    ....
}
```

The `cookie` object is created and included in the server's response\. After the cookie is created, the `Cookie#setSecure` method is called with `false`, explicitly indicating that the `Secure` attribute should not be set for the cookie being created\. 

If the `Secure` attribute is not set in a cookie header, that cookie object will be sent from the browser to the server via both HTTPS and the unsecured HTTP protocol\. As a result, sensitive data from the cookie will be passed in cleartext, and attackers who intercept an unencrypted request can extract the sensitive data without decryption\.

To prevent the browser from sending cookies over the unsecured HTTP protocol, set the appropriate attribute when creating the `Cookie` object:

```cpp
public void servletSecureExample(
  HttpServletRequest request, 
  HttpServletResponse response
) {
    Cookie cookie = new Cookie("name", getCookieValue());
    cookie.setSecure(true);
    response.addCookie(cookie);
    ....
}
```

In this case, the cookie header contains the `Secure` attribute, which indicates to the browser that the cookie can only be sent over the HTTPS protocol\.

It's also recommended to consider the various APIs used to create `Cookie` objects\. Most of these APIs do not set the `Secure` attribute by default when an object is created\.

The examples of insecure cookies:

```cpp
public void insecureCookie(
  HttpServletRequest request, 
  HttpServletResponse response
) {
    Cookie cookie = new Cookie("name", getCookieValue());
    response.addCookie(cookie);
    ....
}
```



```cpp
public void insecureResponseCookie(
  HttpServletRequest request, 
  HttpServletResponse response
) {
    ResponseCookie cookie = ResponseCookie
                 .from("name", getCookieValue())
                 .build();
    response.addHeader(HttpHeaders.SET_COOKIE, cookie.toString());
    ....
}
```