Loosely Scoped Cookie

Remediation

1. Use specific domain scoping: Set cookie domain attributes to specific FQDNs (Fully Qualified Domain Names) instead of wildcard domains.
2. Implement path restrictions: Use specific path attributes to limit cookie accessibility to required application paths only.
3. Review cookie policies: Audit all application cookies to ensure appropriate domain and path scoping.
4. Add security attributes: Include Secure, HttpOnly, and SameSite attributes to enhance cookie security.
5. Regular cookie audits: Periodically review cookie scoping to ensure it remains appropriate as applications evolve.

About

Loosely scoped cookies occur when cookie domain attributes are set too broadly, allowing cookies to be transmitted to parent domains or multiple subdomains. This overly permissive scoping can expose sensitive session data or authentication tokens to unintended domains within the same organization.

Risks

Medium Loosely scoped cookies can lead to session hijacking, cross-subdomain attacks, unauthorized access to sensitive authentication data, and potential compromise of user sessions across multiple applications within the same domain hierarchy.