Session Cookie Accessible for Subdomains

Description

When the Domain attribute is present in the Set-Cookie header, browsers send the cookie to any subdomains of the specified domain. This can result in unintended data exposure and potential security risks, particularly if sensitive information is stored in the cookie.

Recommendation

To restrict cookie access to the current domain only, remove the Domain attribute from the Set-Cookie header. This ensures that the cookie is not accessible to subdomains, thereby reducing the risk of data leakage.

References

• Mozilla: Using HTTP cookies
• MDN Web Docs: Set-Cookie
• CWE-16
• OWASP 2021-A5