HttpOnlyCookies issue exists @ src/main/java/org/joychou/controller/CRLFInjection.java in branch master

The web application's crlf method creates a cookie cookie, at line 23 of src\main\java\org\joychou\controller\CRLFInjection.java, and returns it in the response. However, the application is not configured to automatically set the cookie with the "httpOnly" attribute, and the code does not explicitly add this to the cookie.

Severity: Medium

CWE:1004

Vulnerability details and guidance

Internal Guidance

Checkmarx

Lines: 27

Code (Line #27):

        Cookie cookie = new Cookie("test3", author);