How to fix "does not define sensitive application cookies with the "secure" flag" for ASP.NET core webapi

1.00/5 (1 vote)

See more:

Could someone suggest on below risk raised by checkMarx tool for ASp.NET Core WebAPI, as application don't send or store any cookies.

" Startup.cs application configuration file, at line 21, does not define sensitive application cookies with the "secure" flag, which could cause the client to send those cookies in plaintext over an insecure network communication (HTTP). This may lead to a Session Hijacking attack."

line 21 mentions --- public class Startup

What I have tried:

I have tried ways to add app.UseHsts();app.UseHttpsRedirection(); to request pipeline, not resolved the issue.

Posted 10-Oct-22 1:25am

Tharakharish

Updated 11-Oct-22 1:33am

Add a Solution

Comments

Richard Deeming 11-Oct-22 6:41am

What do you think we could possibly suggest, given we can't see any of the code in question? If the tool says you have a security problem with your code, then you probably have a security problem with your code.

Tharakharish 11-Oct-22 7:35am

@Richard Deeming, Apologies I have updated my question, the line security tool raises risk. pls suggest.

Member 8428760 12-Oct-22 23:59pm

Have you followed what it says for ASP here? https://owasp.org/www-community/controls/SecureCookieAttribute

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Last 24hrs

This month

Richard Deeming	95
Dave Kreskowiak	78
Pete O'Hanlon	20
Luc Pattyn	10
Espen Harlinn	5

Pete O'Hanlon	310
Richard Deeming	285
OriginalGriff	150
merano99	130
Mircea Neacsu	90

How to fix "does not define sensitive application cookies with the "secure" flag" for ASP.NET core webapi

Add your solution here

Preview 0

How to fix "does not define sensitive application cookies with the "secure" flag" for ASP.NET core webapi

Add your solution here

Preview 0

Existing Members

...or Join us