From c734e74c762fed97a7c1af411cc3f13397490689 Mon Sep 17 00:00:00 2001 From: Joe Farebrother Date: Fri, 24 Oct 2025 15:50:57 +0100 Subject: [PATCH] Update qhelp --- .../CWE-1004/CookieWithoutHttpOnly.qhelp | 37 ++++++++++++------- .../src/Security Features/CWE-1004/Web.config | 6 +++ .../CWE-614/CookieWithoutSecure.qhelp | 36 ++++++++++-------- 3 files changed, 50 insertions(+), 29 deletions(-) create mode 100644 csharp/ql/src/Security Features/CWE-1004/Web.config diff --git a/csharp/ql/src/Security Features/CWE-1004/CookieWithoutHttpOnly.qhelp b/csharp/ql/src/Security Features/CWE-1004/CookieWithoutHttpOnly.qhelp index c7c10a3af9e..06bd1e336f5 100644 --- a/csharp/ql/src/Security Features/CWE-1004/CookieWithoutHttpOnly.qhelp +++ b/csharp/ql/src/Security Features/CWE-1004/CookieWithoutHttpOnly.qhelp @@ -4,48 +4,57 @@ -

-Cookies without HttpOnly flag are accessible to JavaScript running in the same origin. In case of -Cross-Site Scripting (XSS) vulnerability the cookie can be stolen by malicious script. -

+

Cookies without the HttpOnly flag set are accessible to client-side scripts such as JavaScript running in the same origin. +In case of a Cross-Site Scripting (XSS) vulnerability, the cookie can be stolen by a malicious script. +If a sensitive cookie does not need to be accessed directly by client-side JS, the HttpOnly flag should be set.

-Protect sensitive cookies, such as related to authentication, by setting HttpOnly to true to make -them not accessible to JavaScript. In ASP.NET case it is also possible to set the attribute via <httpCookies> element -of web.config with the attribute httpOnlyCookies="true". +Set the HttpOnly flag to true for authentication cookies to ensure they are not accessible to client-side scripts. +

+

+When using ASP.NET Core, CookiePolicyOptions can be used to set a default policy for cookies. + +When using ASP.NET Web Forms, a default may also be configured in the Web.config file, using the httpOnlyCookies attribute of the +the <httpCookies> element.

-In the example below Microsoft.AspNetCore.Http.CookieOptions.HttpOnly is set to true. +In the example below, Microsoft.AspNetCore.Http.CookieOptions.HttpOnly is set to true.

-In the following example CookiePolicyOptions are set programmatically to configure defaults. +In the following example, CookiePolicyOptions are set programmatically to configure defaults.

-In the example below System.Web.HttpCookie.HttpOnly is set to true. +In the example below, System.Web.HttpCookie.HttpOnly is set to true.

+

+In the example below, the httpOnlyCookies attribute is set to true in the Web.config file. +

+ + -
  • CookieOptions.HttpOnly Property,
    • -
  • Set-Cookie Header,
    • -
  • HttpCookie.HttpOnly Property,
    • -
  • httpCookies Element,
    • +
  • ASP.Net Core docs: CookieOptions.HttpOnly Property.
    • +
  • MDN: Set-Cookie Header
    • . +
  • Web Forms docs: HttpCookie.HttpOnly Property.
    • +
  • Web Forms docs: httpCookies Element.
    • +
  • PortSwigger: Cookie without HttpOnly flag set
    •      diff --git a/csharp/ql/src/Security Features/CWE-1004/Web.config b/csharp/ql/src/Security Features/CWE-1004/Web.config new file mode 100644 index 00000000000..8f4cf5ba777 --- /dev/null +++ b/csharp/ql/src/Security Features/CWE-1004/Web.config @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/csharp/ql/src/Security Features/CWE-614/CookieWithoutSecure.qhelp b/csharp/ql/src/Security Features/CWE-614/CookieWithoutSecure.qhelp index ddf825aed26..f122c4d881b 100644 --- a/csharp/ql/src/Security Features/CWE-614/CookieWithoutSecure.qhelp +++ b/csharp/ql/src/Security Features/CWE-614/CookieWithoutSecure.qhelp @@ -4,33 +4,32 @@ -

    -Sensitive data that is transmitted using HTTP is vulnerable to being read by a third party. By default, -cookies are sent via HTTP, not HTTPS. -

    +

    Cookies without the Secure flag set may be transmitted using HTTP instead of HTTPS. +This leaves them vulnerable to being read by a third party attacker. If a sensitive cookie such as a session +key is intercepted this way, it would allow the attacker to perform actions on a user's behalf.

    -In ASP.NET case when using cookies ensure that HTTPS is used by setting the property Microsoft.AspNetCore.Http.CookieOptions.Secure to true. +When using ASP.NET Core, ensure cookies have the secure flag set by setting Microsoft.AspNetCore.Http.CookieOptions.Secure to true, or +using CookiePolicyOptions to set a default security policy.

    -In ASP.NET Core case when using cookies, ensure that HTTPS is used, either via the <forms> attribute above, or -the <httpCookies> element, with the attribute requireSSL="true". It is also possible to require cookies -to use HTTPS programmatically, by setting the property System.Web.HttpCookie.Secure to true. +When using ASP.NET Web Forms, cookies can be configured as secure by default in the Web.config file, setting the requireSSL attribute to true in the forms or httpCookies element. +Cookies may also be set to be secure programmatically by setting the System.Web.HttpCookie.Secure attribute to true.

    -In the example below Microsoft.AspNetCore.Http.CookieOptions.Secure is set to true programmatically. +In the example below, Microsoft.AspNetCore.Http.CookieOptions.Secure is set to true.

    -In the following example CookiePolicyOptions are set programmatically to configure defaults. +In the following example, CookiePolicyOptions are set programmatically to configure defaults.

    @@ -41,15 +40,22 @@ In the example below System.Web.HttpCookie.Secure is set to t +

    +In the example below, the requireSSL attribute is set to true in the forms element of the Web.config file. +

    + +     -
  • CookieOptions.Secure Property,
    • -
  • Set-Cookie Header,
    • -
  • FormsAuthentication.RequireSSL Property,
    • -
  • forms Element for authentication,
    • -
  • httpCookies Element,
    • +
  • ASP.NET Core docs: CookieOptions.Secure Property.
    • +
  • MDN: Set-Cookie Header.
    • +
  • Web Forms docs: FormsAuthentication.RequireSSL Property.
    • +
  • Web Forms docs: forms Element for authentication.
    • +
  • Web Forms docs: httpCookies Element.
    • +
  • Detectify: Cookie lack Secure flag.
    • +
  • PortSwigger: TLS cookie without secure flag set.
    •