Vulnerabilty fixes for cookies

[rolex135]

1. Cookies Not Marked as Secure One or more cookies does not have the Secure flag set. When a cookie is set with the Secure ag, it instructs the browser that the cookie can only be accessed over secure SSL/TLS channels. This is an important security protection for session cookies. Impact Cookies could be sent over unencrypted channels. Cookies without Secure flag set: https://example/app/init Set-Cookie: session=eyJjc3JmX3Rva2VuIjoiMzRkNzZhZGQ5YTBiMzlmMmJlNWM0ZDVmMjc0MDc4ZDBhNTczZmQwO SJ9.ZlR8tA._QL2Wzj-jMPpLj-AUbNIFcYoIPc; HttpOnly; Path=/ Request GET /app/init HTTP/1.1 Host: example accept: application/json, text/plain, / accept-language: en-US x-client: vue Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://example/ Accept-Encoding: gzip,deflate,br Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Recommendation If possible, you should set the Secure ag for these cookies.

2. Cookies with missing, inconsistent or contradictory properties At least one of the following cookies properties causes the cookie to be invalid or incompatible with either a different property of the same cookie, of with the environment the cookie is being used in. Although this is not a vulnerability in itself, it will likely lead to unexpected behavior by the application, which in turn may cause secondary security issues. Impact Cookies will not be stored, or submitted, by web browsers. List of cookies with missing, inconsistent or contradictory properties: https://example/app/init Cookie was set with: Set-Cookie: session=eyJjc3JmX3Rva2VuIjoiZTY0YTcxNmY3YWYwYjM3ZmVhOTI5ZjcyOTBiODk4ZjY1NmUwMmM0M yJ9.ZlR00Q.BP5Tl4PUH3ocWyLWnKzG2Gy7YxI; HttpOnly; Path=/ This cookie has the following issues: Cookie without SameSite attribute. When cookies lack the SameSite attribute, Web browsers may apply different and sometimes unexpected defaults. It is therefore recommended to add a SameSite attribute with an appropriate value of either "Strict", "Lax", or "None". Request GET /app/init HTTP/1.1 Host: example accept: application/json, text/plain, / accept-language: en-US x-client: vue Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://example/ Accept-Encoding: gzip,deflate,br Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Recommendation Ensure that the cookies configuration complies with the applicable standards.