# V5630\. OWASP\. Possible cookie injection\. Potentially tainted data is used to create a cookie\.

The analyzer has detected that unverified external data is used to create a cookie object\. If this data is compromised, it may cause a cookie injection\.

The example:

```cpp
public void ChangeCookie()
{
  String cookieValue = Request.Form["userRole"];

  Response.Cookies.Add(
    new HttpCookie(WebLocalizationConfiguration.CookieName, cookieValue)
    {
      Expires = Clock.Now.AddYears(2),
      Path = Request.ApplicationPath
    }
  );
  ....
}
```

In this case, a new object of the `HttpCookie` class is added to `HttpResponse` and is initialized using the external data, `Request.Form`\. Using data without any verification or validation can allow attackers to manipulate an application\.

To protect code against cookie injections, ensure that any data used to initialize the `HttpCookie` object is validated\.

The fixed code:

```cpp
public void ChangeCookie()
{
  String cultureValue = Request.Form["userRole"];
  
  if (!Regex.IsMatch(cultureValue, DataValidationPattern))
    return;

  Response.Cookies.Add(
    new HttpCookie(WebLocalizationConfiguration.CookieName, cultureValue)
    {
      Expires = Clock.Now.AddYears(2),
      Path = Request.ApplicationPath
    }
  );
  ....
}
```

Before initializing the `HttpCookie` object with potentially tainted data, execute a validation check via a regular expression\.