CSHARP.LIB.HTTP.COOKIE : Insecure Cookie (C#)

JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

If you access the manual through the hub's Web GUI, the functionality will not be suppressed because the hub is a web server.
Alternatively, your browser may allow you to explicitly disable the security setting that suppresses functionality. See the CodeSonar FAQ for more information.

CodeSonar^® 9.2p0

CONFIDENTIAL

CodeSecure Inc

CSHARP.LIB.HTTP.COOKIE : Insecure Cookie (C#)

要旨

Cookies are tokens of information exchanged over a network connection. If that connection is encrypted, cookies are expected to be encrypted as well. However, this might not be the case if a cookie's secure flag is not set. This checker finds such insecure situations.

プロパティ

例

using System;
using System.Web;
using System.Web.UI;

namespace DocumentationExamples
{
  public class Cookie : Page
  {
    public static void Main(string[] args)
    { }
      protected void Page_Load(object sender, EventArgs e)
    {
      Test1();
      Test2();
      Test3();
      Test4();
      Test5();
      Test6();
      Test7();
    }
    private void Test1()
    {
      HttpCookie cookie = new HttpCookie("cake", "special value here")
      {
        Secure = true
      };
      Response.Cookies.Add(cookie);
    }
    private void Test2()
    {
      HttpCookie cookie = new HttpCookie("cake", "special value here")
      {
        Secure = false
      };
      Console.WriteLine("danger here!");
      Response.Cookies.Add(cookie);   // "Insecure Cookie (C#)" warning issued here
    }
    private void Test3()
    {
      HttpCookie cookie = GetSecureCookie();
      Response.Cookies.Add(cookie);                            // ok: getSecureCookie returns a cookie whose Secure flag is set
    }
    private void Test4()
    {
      HttpCookie cookie = GetInsecureCookie();
      Response.Cookies.Add(cookie);   // "Insecure Cookie (C#)" warning issued here
    }
    private HttpCookie GetSecureCookie()
    {
      HttpCookie cookie = new HttpCookie("cake", "special value here")
      {
        Secure = true
      };
      return cookie;
    }
    private HttpCookie GetInsecureCookie()
    {
      HttpCookie cookie = new HttpCookie("cake", "special value here")
      {
        Secure = DateTime.Now.Millisecond % 2 == 0
      };
      return cookie;
    }
    private void Test5()
    {
      HttpCookie cookie = new HttpCookie("cake", "special value here");
      Response.Cookies.Add(cookie);   // "Insecure Cookie (C#)" warning issued here
    }
    private void Test6()
    {
      HttpCookie cookie = GetInsecureCookie();
      HttpCookie copy = cookie;
      cookie.Secure = true;
      Response.Cookies.Add(cookie);                            // ok: cookie.Secure explicitly set to true
    }
    private void Test7()
    {
      HttpCookie cookie = GetInsecureCookie();
      cookie.Secure = true;
      HttpCookie copy = cookie;
      copy.Secure = false;
      Response.Cookies.Add(cookie);   // "Insecure Cookie (C#)" warning issued here
    }
  }
}

解決法

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。