HIGH AI PREVALENCE: HIGH auth.java.cookie.insecure

A servlet Cookie is created with a security attribute explicitly disabled.

CWE-614 OWASP API8:2023 java

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

setSecure(false) lets the cookie travel over plain HTTP, and setHttpOnly(false) makes it readable from JavaScript. Either way a session or auth cookie can be intercepted or stolen (CWE-614). This is a common AI-generated mistake where the flag is set to false to "make it work" over localhost and never switched back.

Set cookie.setSecure(true) and cookie.setHttpOnly(true) on every session or authentication cookie, and add SameSite (e.g. Strict or Lax) to further limit cross-site exposure.

VULNERABLE

vulnerable.java

import jakarta.servlet.http.Cookie;
import jakarta.servlet.http.HttpServletResponse;

class CookieConfig {

    void loginSession(HttpServletResponse response) {
        Cookie session = new Cookie("SESSION", "abc123");
        // ruleid: auth.java.cookie.insecure
        session.setSecure(false);
        response.addCookie(session);
    }

    void authToken(HttpServletResponse response) {
        Cookie auth = new Cookie("AUTH_TOKEN", "tok");
        // ruleid: auth.java.cookie.insecure
        auth.setHttpOnly(false);
        response.addCookie(auth);
    }

    void refreshCookie(HttpServletResponse response) {
        Cookie refresh = new Cookie("REFRESH", "r");
        // ruleid: auth.java.cookie.insecure
        refresh.setSecure(false);
        refresh.setHttpOnly(true);
        response.addCookie(refresh);
    }
}

SAFE

safe.java

import jakarta.servlet.http.Cookie;
import jakarta.servlet.http.HttpServletResponse;

class SafeCookieConfig {

    void loginSession(HttpServletResponse response) {
        Cookie cookie = new Cookie("SESSION", "abc123");
        // ok: auth.java.cookie.insecure
        cookie.setSecure(true);
        cookie.setHttpOnly(true);
        response.addCookie(cookie);
    }

    void noFlags(HttpServletResponse response) {
        Cookie cookie = new Cookie("PREFS", "dark");
        // ok: auth.java.cookie.insecure
        response.addCookie(cookie);
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.java.cookie.insecure -- <reason>

References

https://owasp.org/www-community/controls/SecureCookieAttribute ↗https://cwe.mitre.org/data/definitions/614.html ↗