When a cookie is protected with the `secure` attribute set to true it will not be send by the browser over an unencrypted HTTP request and thus cannot be observed by an unauthorized person during a man-in-the-middle attack.

## Ask Yourself Whether

- the cookie is for instance a session-cookie not designed to be sent over non-HTTPS communication.
- it’s not sure that the website contains mixed content or not (ie HTTPS everywhere or not)

There is a risk if you answered yes to any of those questions.

## Recommended Secure Coding Practices

- It is recommended to use `HTTPs` everywhere so setting the `secure` flag to true should be the default behaviour when creating cookies.
- Set the `secure` flag to true for session-cookies.

## Sensitive Code Example

In php.ini you can specify the flags for the session cookie which is security-sensitive:

    session.cookie_secure = 0; // Sensitive: this security-sensitive session cookie is created with the secure flag set to false (cookie_secure = 0)

Same thing in PHP code:

    session_set_cookie_params($lifetime, $path, $domain, false);
    // Sensitive: this security-sensitive session cookie is created with the secure flag (the fourth argument) set to _false_

If you create a custom security-sensitive cookie in your PHP code:

    $value = "sensitive data";
    setcookie($name, $value, $expire, $path, $domain, false);  // Sensitive: a security-sensitive cookie is created with the secure flag  (the sixth argument) set to _false_

By default `setcookie` and `setrawcookie` functions set the sixth argument / `secure` flag to false:

    $value = "sensitive data";
    setcookie($name, $value, $expire, $path, $domain);  // Sensitive: a security-sensitive cookie is created with the secure flag (the sixth argument) not defined (by default to false)
    setrawcookie($name, $value, $expire, $path, $domain);  // Sensitive: a security-sensitive cookie is created with the secure flag (the sixth argument) not defined (by default to false)

## Compliant Solution

    session.cookie_secure = 1; // Compliant: the sensitive cookie will not be send during an unencrypted HTTP request thanks to cookie_secure property set to 1

    session_set_cookie_params($lifetime, $path, $domain, true); // Compliant: the sensitive cookie will not be send during an unencrypted HTTP request thanks to the secure flag (the fouth argument) set to true

    $value = "sensitive data";
    setcookie($name, $value, $expire, $path, $domain, true); // Compliant: the sensitive cookie will not be send during an unencrypted HTTP request thanks to the secure flag (the sixth  argument) set to true
    setrawcookie($name, $value, $expire, $path, $domain, true);// Compliant: the sensitive cookie will not be send during an unencrypted HTTP request thanks to the secure flag (the sixth argument) set to true

## See

- OWASP - Top 10 2021 Category A4 - Insecure Design
- OWASP - Top 10 2021 Category A5 - Security Misconfiguration
- OWASP - Top 10 2017 Category A3 - Sensitive Data Exposure
- CWE - CWE-311 - Missing Encryption of Sensitive Data
- CWE - CWE-315 - Cleartext Storage of Sensitive Information in a Cookie
- CWE - CWE-614 - Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
- STIG Viewer - Application Security and Development: V-222576 - The application must set the secure flag on session cookies.