diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2092.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2092.html index e7ff92ba619..b6811fa8c40 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2092.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2092.html @@ -1,35 +1,39 @@

When a cookie is protected with the secure attribute set to true it will not be send by the browser over an unencrypted HTTP request and thus cannot be observed by an unauthorized person during a man-in-the-middle attack.

-

Ask Yourself Whether

- -

There is a risk if you answered yes to any of those questions.

-

Recommended Secure Coding Practices

- -

Sensitive Code Example

+

Why is this an issue?

+

When a cookie is created without the secure attribute set to true, browsers will transmit it over unencrypted HTTP +connections as well as HTTPS. An attacker who can observe or intercept network traffic—for example on a public Wi-Fi network—can read the cookie value +in cleartext.

+

What is the potential impact?

+

Session hijacking

+

If a session cookie is transmitted over an unencrypted HTTP connection, an attacker who can intercept the traffic can steal it. With a valid +session cookie, the attacker can impersonate the victim and gain full access to their account without knowing their password. Even on sites that +primarily use HTTPS, a single HTTP request containing the session cookie is enough to expose it.

+

How to fix it in Servlet

+

Call setSecure(true) on the Cookie object to ensure it is only transmitted over HTTPS.

+

Code examples

+

Noncompliant code example

If you create a security-sensitive cookie in your JAVA code:

-
+
 Cookie c = new Cookie(COOKIENAME, sensitivedata);
-c.setSecure(false);  // Sensitive: a security-ensitive cookie is created with the secure flag set to false
+c.setSecure(false);  // Noncompliant
 

 
By default the secure flag is set
 to false:

-
-Cookie c = new Cookie(COOKIENAME, sensitivedata);  // Sensitive: a security-sensitive cookie is created with the secure flag not defined (by default set to false)
+
+Cookie c = new Cookie(COOKIENAME, sensitivedata);  // Noncompliant: cookies are created by default without a secure flag
+

+
Compliant solution

+
+Cookie c = new Cookie(COOKIENAME, sensitivedata);
+c.setSecure(true);
 

-
Compliant Solution

-
+
 Cookie c = new Cookie(COOKIENAME, sensitivedata);
-c.setSecure(true); // Compliant: the sensitive cookie will not be send during an unencrypted HTTP request thanks to the secure flag set to true
+c.setSecure(true);
 

-
See

+
Resources

+
Standards

 
    
   
  • OWASP - Top 10 2021 Category A4 - Insecure Design
    • 
   
  • OWASP - Top 10 2021 Category A5 - Security Misconfiguration
    • 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2092.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2092.json
index 57451ebcbc6..56c30f558e7 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2092.json
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2092.json
@@ -1,6 +1,7 @@
 {
-  "title": "Creating cookies without the \"secure\" flag is security-sensitive",
-  "type": "SECURITY_HOTSPOT",
+  "title": "Cookies should have the \"secure\" flag",
+  "type": "VULNERABILITY",
+  "quickfix": "unknown",
   "code": {
     "impacts": {
       "SECURITY": "LOW"
@@ -49,6 +50,5 @@
     "STIG ASD_V5R3": [
       "V-222576"
     ]
-  },
-  "quickfix": "unknown"
+  }
 }
diff --git a/sonarpedia.json b/sonarpedia.json
index 2046b338a4b..2e806aecbf2 100644
--- a/sonarpedia.json
+++ b/sonarpedia.json
@@ -3,7 +3,7 @@
   "languages": [
     "JAVA"
   ],
-  "latest-update": "2026-03-12T13:07:16.598544876Z",
+  "latest-update": "2026-04-09T13:46:03.313330Z",
   "options": {
     "no-language-in-filenames": true,
     "preserve-filenames": false