Skip to content

Commit

Permalink
Update InsecureCookie.qhelp
Browse files Browse the repository at this point in the history
Gratuitous commit to nudge CI
  • Loading branch information
smowton authored Oct 30, 2024
1 parent a979988 commit 5f31adc
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion python/ql/src/Security/CWE-614/InsecureCookie.qhelp
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
<qhelp>

<overview>
<p>Cookies without the <code>Secure</code> flag set may be transmitted using HTTP instead of HTTPS, which leaves them vulnerable to being read by a third party.</p>
<p>Cookies without the <code>Secure</code> flag set may be transmitted using HTTP instead of HTTPS, which leaves them vulnerable to reading by a third party.</p>
<p>Cookies without the <code>HttpOnly</code> flag set are accessible to JavaScript running in the same origin. In case of a Cross-Site Scripting (XSS) vulnerability, the cookie can be stolen by a malicious script.</p>
<p>Cookies with the <code>SameSite</code> attribute set to <code>'None'</code> will be sent with cross-origin requests, which can be controlled by third-party JavaScript code and allow for Cross-Site Request Forgery (CSRF) attacks.</p>
</overview>
Expand Down

0 comments on commit 5f31adc

Please sign in to comment.