When a cookie is protected with the secure attribute set to true it will not be send by the browser over an unencrypted HTTP request and thus cannot be observed by an unauthorized person during a man-in-the-middle attack. By default the secure flag is set to false and so cookies can be stolen if a man-in-the-attack is performed.

Ask Yourself Whether

* the cookie is a session-cookie and the secure flag is set to false

* the content of the cookie is sensitive and the secure flag is set to false

You are at risk if you answered yes to any of those questions.

Recommended Secure Coding Practices

* It is recommended to use HTTPs everywhere so setting the secure flag to true should be the default behaviour when creating cookies.

* Set the secure flag to true for session / sensitive-security cookies.

Sensitive Code Examples

In php.ini you can specify the flags for the session cookie which is security-sensitive:

session.cookie_secure = 0; // Sensitive: this security-sensitive session cookie is created with the secure flag set to false (cookie_secure = 0)

Same thing in PHP code:

session_set_cookie_params($lifetime, $path, $domain, false);
// Sensitive: this security-sensitive session cookie is created with the secure flag (the fourth argument) set to _false_

If you create a custom security-sensitive cookie in your PHP code:

$value = "sensitive data";
setcookie($name, $value, $expire, $path, $domain, false);  // Sensitive: a security-sensitive cookie is created with the secure flag  (the sixth argument) set to _false_

By default setcookie and setrawcookie functions set the sixth argument / secure flag to false:

$value = "sensitive data";
setcookie($name, $value, $expire, $path, $domain);  // Sensitive: a security-sensitive cookie is created with the secure flag (the sixth argument) not defined (by default to false)
setrawcookie($name, $value, $expire, $path, $domain);  // Sensitive: a security-sensitive cookie is created with the secure flag (the sixth argument) not defined (by default to false)

Compliant Solution

session.cookie_secure = 1; // Compliant: the sensitive cookie will not be send during an unencrypted HTTP request thanks to cookie_secure property set to 1
session_set_cookie_params($lifetime, $path, $domain, true); // Compliant: the sensitive cookie will not be send during an unencrypted HTTP request thanks to the secure flag (the fouth argument) set to true
$value = "sensitive data";
setcookie($name, $value, $expire, $path, $domain, true); // Compliant: the sensitive cookie will not be send during an unencrypted HTTP request thanks to the secure flag (the sixth  argument) set to true
setrawcookie($name, $value, $expire, $path, $domain, true);// Compliant: the sensitive cookie will not be send during an unencrypted HTTP request thanks to the secure flag (the sixth argument) set to true

See

* OWASP Top 10 2017 Category A3 - Sensitive Data Exposure

* MITRE, CWE-311 - Missing Encryption of Sensitive Data

* MITRE, CWE-315 - Cleartext Storage of Sensitive Information in a Cookie

* MITRE, CWE-614 - Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

* SANS Top 25 - Porous Defenses