Fix it in your stack

Tested fixes for CWE-1004 in Express, Flask, Spring Boot, ASP.NET Core, Rails and Laravel: the vulnerable code, the fix, a plausible fix that still fails, and the regression tests.

Definition

MITRE’s description of CWE-1004: The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

Common consequences MITRE lists

  • Confidentiality: Read Application Data
  • Integrity: Gain Privileges or Assume Identity

Why it matters

Any cross-site scripting flaw can then steal the session token outright and use it from the attacker’s own machine.

How to prevent it

  • Set HttpOnly on session cookies and other sensitive cookies that scripts do not need.
  • Keep session tokens out of localStorage and other storage that scripts can read.
  • Still fix XSS: HttpOnly stops cookie theft, not actions taken from inside the page.

Guides on this site

Also covers this · Guide

Session management: cookies, timeouts, rotation and revocation

Model authentication as transitions in server authority, set session cookies and timeouts to current NIST and OWASP values, and verify fixation prevention, expiry, reauthentication, revocation and stolen-cookie defenses.

Also covers this · Guide

Configure HTTP security headers from a tested baseline

Send the response headers that make browsers enforce HTTPS, run only your own scripts, refuse hostile framing and keep cookies on one host, then prove they appear on every kind of response.

Practice

References

  1. CWE-1004 in the MITRE CWE list (version 4.20)

List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.

CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.