CWE-565 (在信任Cookie未进行验证与完整性检查) — Vulnerability Class 20

CWE-565 represents a critical input validation weakness where applications trust cookie data without verifying its integrity or authenticity. Attackers typically exploit this by manipulating cookie values, such as altering session identifiers or privilege flags, to impersonate legitimate users or escalate permissions. Since cookies are client-side and easily modified, relying on them for security decisions allows adversaries to bypass authentication mechanisms or access unauthorized resources. To mitigate this risk, developers must implement server-side validation for all security-critical operations, ensuring that cookie data is cross-referenced with secure server sessions. Additionally, using cryptographic signing or digital signatures for cookie contents helps detect tampering, while enforcing strict access controls ensures that sensitive actions are never solely dependent on unverified client-side information.