Leakage of sensitive data in cookie

• Rule ID: ruby_lang_cookies
• Languages: ruby
• Source: cookies.yml

Description

Storing sensitive data in cookies can lead to a data breach. This rule looks for instances where sensitive data is stored in browser cookies.

Remediations

❌ Avoid storing sensitive data in unencrypted cookies messages:

cookies[:user_email] = "john@doe.com"

✅ To ensure cookie data stays safe, use encrypted cookies:

cookies.encrypted[:user_email] = "john@doe.com"

Resources

• Cookie object documentation: ActionDispatch::Cookies
• Demystifying cookie security in rails 6

Associated CWE

• CWE-315: Cleartext Storage of Sensitive Information in a Cookie

OWASP Top 10

• A05:2021 - Security Misconfiguration

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=ruby_lang_cookies

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=ruby_lang_cookies