Insecure Cookie (ARCH4123)

Key java.security.insecure-cookie · Severity warning · Category security · CWE CWE-614

Cookies without the Secure flag are also sent over unencrypted HTTP, exposing them to network eavesdroppers. Always mark session cookies Secure.

Incorrect

Cookie cookie = new Cookie("SESSION", token);
cookie.setHttpOnly(true);
response.addCookie(cookie); // no Secure -> sent over http too

Correct

Cookie cookie = new Cookie("SESSION", token);
cookie.setHttpOnly(true);
cookie.setSecure(true);
response.addCookie(cookie);

Fix

Call setSecure(true) on session/auth cookies.