Description

User’s session id with secure attribute is false. This vulnerability makes user’s cookies can be sent to the server with an unencrypted request over the HTTP protocol.

Proof of Concept

Open the browser and get access to the minarca website, for this scenario I have used the demo/test website. Check the cookie in browser’s dev tool and realize that the cookie with Secure attribute is false.