HttpOnly Cookie - Detect

What is the "HttpOnly Cookie - Detect" module?

The "HttpOnly Cookie - Detect" module is designed to detect misconfigurations related to the HttpOnly attribute in cookies. It targets HTTP responses and checks whether the cookies contain the HttpOnly attribute. The HttpOnly flag indicates that the cookie is HTTP-only, meaning it cannot be accessed by client-side scripts, reducing the risk of cross-site scripting (XSS) attacks.

This module is classified as informative, meaning it provides valuable information about the presence or absence of the HttpOnly attribute in cookies, but it does not indicate a vulnerability or software fingerprint.

This module was authored by Mr. Bobo HP.

Impact

The presence or absence of the HttpOnly attribute in cookies can have security implications. If the HttpOnly flag is not set, it may expose the cookie to potential XSS attacks, allowing malicious scripts to access sensitive information stored in the cookie. By detecting whether cookies have the HttpOnly attribute, this module helps identify potential security risks and allows for appropriate remediation measures.

How does the module work?

The "HttpOnly Cookie - Detect" module operates by analyzing the HTTP response headers for the presence of the "Set-Cookie" and "HttpOnly" keywords. It uses matching conditions to check if both keywords are present in the header, indicating that the cookie has the HttpOnly attribute.

Here is an example of an HTTP response header that would match the conditions:

Set-Cookie: sessionId=abc123; HttpOnly

In this example, the "Set-Cookie" header contains the "HttpOnly" attribute, indicating that the cookie is HTTP-only.

By evaluating the matching conditions, this module helps identify whether cookies have the HttpOnly attribute, providing valuable insights into the security posture of the web application.

For more information, you can refer to the Stack Overflow community.