CVE ID(s)

List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the GitHub Advisory Database.

• There is no CVE for this.

Report

Failing to set the secure flag on a cookie can cause it to be sent in clear text. This makes it easier for an attacker to intercept and read the cookie.

Query to detect if the secure flag is set to cookies is available in java query but it is not available in JavaScript query.
This query detects if cookies are sent without the flag secure being set or with the flag secure being set to false.

Link to the merged PR: PR github/codeql#3978

• Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing

Result(s)

The query was able to detect the following issues (now fixed):