Cookie Accessible for Subdomains

Description

The presence of the Domain attribute in the Set-Cookie header instructs browsers to send the cookie to any subdomains of the specified domain. This can lead to unintended data exposure and potential security risks if sensitive information is stored in the cookie.

Recommendation

To limit cookie access to the current domain only, remove the Domain attribute from the Set-Cookie header. This ensures that the cookie is not accessible to subdomains, reducing the risk of data leakage.

References

• Mozilla: Using HTTP cookies
• MDN Web Docs: Set-Cookie
• CWE-16
• OWASP 2021-A5

Related Issues

• Session Cookie Accessible for Subdomains - Vulnerability
• Session Cookie without HttpOnly Flag - Vulnerability
• Session Cookie without SameSite Flag - Vulnerability
• Session Cookie without Secure Flag - Vulnerability

Tags:

HTTP Headers

Cookie

Data Security

Application Misconfiguration