Amazon QDetector Library Sign in to Amazon Q

Amazon Q

Detector Library

Scala detectors (48/48)

Improper Neutralization of Special Elements in Data Query Cookie Without Http Only Flag EL Injection Avoid Persistent Cookies OS command injection Improper Authentication Argument Injection Insecure host name verifier Server-Side Request Forgery Insecure Cryptography Template Injection Expression Language Injection Integer Overflow Log Injection Untrusted data in http session LDAP Injection Insecure LDAP Configuration SMTP injection Insecure connection using unencrypted protocol Deserialization of Untrusted Data HTTP response splitting Insecure servlet handling Incorrect Permission Assignment Improper handling of unicode encoding SQL injection Use of Insufficiently Random Values Insecure cookie Code Injection CRLF Injection Use Of RSA Algorithm Path Traversal URL redirection to untrusted site Improper Validation Of Array Index Hardcoded credentials Insufficient Protected Credentials Insecure jax endpoint usage XML External Entity Insecure CORS policy JS eval External Access to Files or Directories Incorrect Certificate Hostname Verification Externally-Controlled Format String NoSQL injection Improper privilege management Cross Site Request Forgery Cross-site scripting Improper Certificate Validation Disabled HTML autoescape

Cookie Without Http Only Flag High

The HttpOnly attribute when set to true protects the cookie value from being accessed by client side JavaScript such as reading the document.cookie values. By enabling this protection, a website that is vulnerable to Cross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie value from JavaScript.

Detector ID

scala/cookie-without-http-only-flag@v1.0

Category

Common Weakness Enumeration (CWE)

Tags

-