> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/4-sast/2-java/permissive-http-only-option-in-cookie-configuration.md).

# Permissive HTTP Only option in cookie configuration

## Overview

* **Rule ID**: `java_lang_cookie_with_http_only_false`
* **Applicable Languages**: Java
* **Weakness ID**: CWE-1004

## Description

Failing to set the HTTP Only option to true in cookie configuration exposes your application to attacks, enabling client-side scripts to access cookie values. This vulnerability can result in unauthorized access or exploits.

## Remediation Guidelines

* **Set** `HttpOnly` to `true` for cookies to prevent client-side scripts from accessing cookie values. This step is crucial for enhancing your application's security by restricting access to sensitive cookie data.

  ```java
  cookie.setHttpOnly(true);
  ```

## References

* [**CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag**](https://cwe.mitre.org/data/definitions/1004.html)
* [**A05:2021 - Security Misconfiguration**](https://owasp.org/Top10/A05_2021-Security_Misconfiguration/)

## Configuration

To omit this rule during a scan, and to provide you with continuous 24/7 code-level scanning, you can employ our [**SAST TOOL**](https://scopy.sec1.io/login)