Attackers can use widely-available tools to view cookies and read any sensitive information they may contain. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

Moreover, cookies should be used only to manage the user session. All information relating to the user should be associated internally to the user session, and should never be sent to the client. In a very few corner cases, cookies can be used for non-sensitive information that needs to live longer than the user session.

This rule raises an issue when data is stored in a cookie. Issues raised are intended to be reviewed by a security auditor as the false-positive rate will be high. It's indeed impossible to statically check if the data stored in the cookie is sensitive or not.

Noncompliant Code Example

void aServiceMethodSettingCookie(HttpServletRequest request, HttpServletResponse response){
    Cookie cookie = new Cookie("userAccountID", acctID);
    response.addCookie(cookie);
}

See