Common Weakness Enumeration
CWE Definition / CWE-1004
CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
Published:2 Jan 2017
Organization:MITRE
Modified:30 Apr 2026
Related Weakness
CWE-732: Incorrect Permission Assignment for Critical Resource
