All interactions between the client and the application should be tested at least against the following criteria:

  1. Are all Set-Cookie directives tagged as Secure?

  2. Do any Cookie operations take place over unencrypted transport?

  3. Can the Cookie be forced over unencrypted transport?

  4. If so, how does the application maintain security?

  5. Are any Cookies persistent?

  6. What Expires = times are used on persistent cookies, and are they reasonable?

  7. Are cookies that are expected to be transiently configured as such?

  8. What HTTP/1.1 Cache-Control settings are used to protect Cookies?

  9. What HTTP/1.0 Cache-Control settings are used to protect Cookies?

How many cookies are used by the application?

Which parts of the application generate and/or modify the cookie?

Which parts of the application require this cookie in order to be accessed and utilized?

Testing methods

Mitigation