CWE-315 (在Cookie中的明文存储) — Vulnerability Class 6

CWE-315 represents a critical data exposure weakness where applications store sensitive information in cleartext within HTTP cookies. This vulnerability allows attackers to easily intercept and read confidential data, such as session tokens or personal identifiers, using widely available browser developer tools or network sniffers. Even if the data appears encoded, attackers can often identify the encoding scheme and decode it to reveal the original content. To mitigate this risk, developers must avoid storing any sensitive data in cookies altogether. If session management is required, they should use secure, HttpOnly, and SameSite cookie attributes to restrict access and transmission. Additionally, implementing robust server-side session management ensures that sensitive state information remains on the server, significantly reducing the attack surface for client-side data theft.