search

jbruinaud / WebGoatNet

WebGoat .Net for demos
0 stars 0 forks source link

CX HttpOnlyCookies @ WebGoatCoins/CustomerLogin.aspx.cs [master] #189

Open jbruinaud opened 4 years ago

jbruinaud commented 4 years ago

HttpOnlyCookies issue exists @ WebGoatCoins/CustomerLogin.aspx.cs in branch master

The web application's ButtonLogOn_Click method creates a cookie cookie, at line 31 of WebGoatCoins\CustomerLogin.aspx.cs, and returns it in the response. However, the application is not configured to automatically set the cookie with the "httpOnly" attribute, and the code does not explicitly add this to the cookie. 

Severity: Medium

CWE:1004

Checkmarx

Lines: 59

Code (Line #59):

            HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encrypted_ticket);