CWE-1004 (没有’HttpOnly’标志的敏感Cookie) — Vulnerability Class 28

CWE-1004 represents a configuration weakness where sensitive data, such as session identifiers, is stored in cookies lacking the HttpOnly attribute. This omission allows client-side scripts, including malicious JavaScript injected via Cross-Site Scripting (XSS) vulnerabilities, to access and exfiltrate the cookie contents. Attackers typically exploit this by executing arbitrary scripts in the victim’s browser to steal session tokens, thereby hijacking user accounts or performing unauthorized actions. To mitigate this risk, developers must explicitly set the HttpOnly flag on all cookies containing sensitive information. This flag instructs the browser to prevent client-side scripts from accessing the cookie, effectively neutralizing XSS-based theft attempts. By enforcing this configuration, organizations ensure that even if an XSS vulnerability exists, the attacker cannot retrieve the critical authentication data stored within the cookie.