Search code examples
javasecuritycookiessonarqube

Should empty cookies intended to delete to be marked as secure?

SonarQube found an issue (Cookies should be "secure") in the following code:

public static void eraseSamlCookie(final HttpServletResponse response) {
    final String cookieName = Config.getParameter(Constants.SSO_COOKIE_NAME);
    if (cookieName != null) {
        final Cookie cookie = new Cookie(cookieName, ""); 
        cookie.setMaxAge(0);
        cookie.setPath("/");
        cookie.setHttpOnly(true);
        response.addCookie(cookie);
    }
}

The cookie is created only to delete a cookie with the same name on the client side (max-age=0).

Is there any reasonable reason to mark it as secure? Does the rule should ignore cookies which value is empty and max-age is set to 0?

squid:S2092 description

Solution

  • The rule description was extended and now I see it has sense. Why? This part is important:

    When a cookie is protected with the secure attribute set to true it will not be send by the browser over an unencrypted HTTP request and thus cannot be observed by an unauthorized person during a man-in-the-middle attack. By default the secure flag is set to false and so cookies can be stolen if a man-in-the-attack is performed.

    In my case the only reason to create a cookie is to overwrite the cookie with the same name on the client side. When the cookie is not secured somebody may change its content, so instead of cleaning the cookie on the client side, it can be provided with a different content. It means that making it secure has a lot of sense.