Session must be secure

문서 > 코드 분석 > Static Analysis Rules > Session must be secure

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Metadata

ID: go-security/cookie-secure

Language: Go

Severity: Info

Category: Security

CWE: 614

Description

The Secure attribute of an http.Cookie is a security measure that indicates the cookie should only be sent over secure connections, such as HTTPS. Failing to set the Secure attribute can expose sensitive information to potential attacks, like man-in-the-middle attacks, where an attacker can intercept the communication between the client and the server.

To avoid this vulnerability, always ensure that the Secure attribute is set for cookies containing sensitive information. Also, make sure that your application enforces the use of HTTPS to encrypt the communication between the client and the server. By following these best practices, you can enhance the security of your application and protect user data from potential threats.

Non-Compliant Code Examples

func main () {
    cookie = http.Cookie {
        Path:   "/",
        HttpOnly: true,
    }
}

func main () {
    cookie = http.Cookie {
        Path:   "/",
        HttpOnly: true,
        Secure: false,
    }
}

Compliant Code Examples

func main () {
    cookie = http.Cookie {
        Path:   "/",
        HttpOnly: true,
        Secure: true,
    }
}