Security finding
A cookie looks like a login or role flag the browser could change
Security Warning Severity: High
Part of the audit Cookie security attributes. Finding id: security.trustFlagCookie.
What it costs you
If the server decides who is logged in or what they may see from this cookie, anyone can change it in the browser and get in, or get rights they should not have.
What to do
Check with the developers how the server uses this cookie. Login and rights must come from a session or a signed token checked on the server; a flag in a cookie may only change how the page looks.
What it checks
- Cookie holds a flag the visitor can change
How to fix it
Check what the server trusts
- Ask the developers whether any server code reads [name] to decide on access, prices or rights.
- If it does, replace it with the server-side session, or sign the value and check the signature on every request.
- If it only changes the display, dismiss the finding with that reason.
How to check: The access decision is made from the session on the server; the finding is dismissed with the reason.