Leakage of sensitive data in cookie

Rule ID: ruby_lang_cookies
Languages: ruby
Source: cookies.yml

Description

Storing sensitive data in cookies can lead to a data breach. This vulnerability occurs when sensitive information is stored in browser cookies, putting it at risk of unauthorized access.

Remediations

Do not store sensitive data in unencrypted cookies. This practice can expose sensitive information to potential security threats.
```
cookies[:user_email] = "john@doe.com" # unsafe
```
Do use encrypted cookies to protect sensitive data stored in cookies.
```
cookies.encrypted[:user_email] = "john@doe.com"
```

References

Associated CWE

CWE-315: Cleartext Storage of Sensitive Information in a Cookie

OWASP Top 10

A05:2021 - Security Misconfiguration

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=ruby_lang_cookies

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=ruby_lang_cookies