CWE-614 (HTTPS会话中未设置’Secure’属性的敏感Cookie) — Vulnerability Class 47

CWE-614 represents a configuration weakness where sensitive cookies are transmitted over HTTPS sessions without the Secure attribute enabled. This oversight allows attackers to exploit the vulnerability through man-in-the-middle attacks, even on encrypted connections, by intercepting the cookie if the session inadvertently downgrades to HTTP or if the client fails to enforce HTTPS strictly. Without the Secure flag, browsers may transmit these credentials over unencrypted channels, exposing session identifiers, authentication tokens, or personal data to eavesdroppers. To mitigate this risk, developers must explicitly set the Secure attribute on all cookies containing sensitive information, ensuring they are only transmitted over encrypted HTTPS connections. Additionally, implementing strict transport security headers and validating server configurations can prevent accidental HTTP fallbacks, thereby maintaining the integrity and confidentiality of user sessions throughout the browsing experience.