Cookie Setup
V3.3.1
Verify that cookies have the 'Secure' attribute set, and if the '_Host-' prefix is not used for the cookie name, the '__Secure-' prefix must be used for the cookie name.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
V3.3.2
Verify that each cookie's 'SameSite' attribute value is set according to the purpose of the cookie, to limit exposure to user interface redress attacks and browser-based request forgery attacks, commonly known as cross-site request forgery (CSRF).
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 103, 21, 22, 31, 39, 593, 62
V3.3.3
Verify that cookies have the '__Host-' prefix for the cookie name unless they are explicitly designed to be shared with other hosts.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 22, 31, 39, 593, 61
V3.3.4
Verify that if the value of a cookie is not meant to be accessible to client-side scripts (such as a session token), the cookie must have the 'HttpOnly' attribute set and the same value (e. g. session token) must only be transferred to the client via the 'Set-Cookie' header field.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 21, 22, 31, 39, 593, 61
V3.3.5
Verify that when the application writes a cookie, the cookie name and value length combined are not over 4096 bytes. Overly large cookies will not be stored by the browser and therefore not sent with requests, preventing the user from using application functionality which relies on that cookie.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 39
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
