所創建的 cookie 的 secure 標記沒有設置為 true。
現今的 Web 瀏覽器支持每個 cookie 的 secure 標記。如果設置了該標記，那么瀏覽器只會通過 HTTPS 發送 cookie。通過未加密的通道發送 cookie 將使其受到網絡截取攻擊，因此安全標記有助于保護 cookie 值的保密性。如果 cookie 包含私人數據或帶有會話標識符，那么該標記尤其重要。
例 1：在下面的示例中，在未設置 secure 標記的情況下將 cookie 添加到響應中。
Cookie cookie = new Cookie("emailCookie", email);
response.addCookie(cookie);
secure 標記，那么在 HTTPS 請求過程中設置的 cookie 也會在隨后的 HTTP 請求過程中被發送。通過未加密的無線連接截取網絡信息流對攻擊者而言十分簡單，因此通過 HTTP 發送 cookie（特別是具有會話 ID 的 cookie）可能會危及應用程序安全。
[1] Standards Mapping - OWASP Top 10 2004 - (OWASP 2004) A10 Insecure Configuration Management
[2] Standards Mapping - OWASP Top 10 2007 - (OWASP 2007) A9 Insecure Communications
[3] Standards Mapping - OWASP Top 10 2010 - (OWASP 2010) A9 Insufficient Transport Layer Protection
[4] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II
[5] Standards Mapping - Security Technical Implementation Guide Version 3.4 - (STIG 3.4) APP3250.1 CAT I, APP3250.2 CAT I, APP3250.3 CAT II, APP3250.4 CAT II
[6] Mike Perry Automated HTTPS Cookie Hijacking
[7] Class Cookie Sun Microsystems
[8] Standards Mapping - FIPS200 - (FISMA) CM, SC
[9] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 614
[10] Standards Mapping - Web Application Security Consortium 24 + 2 - (WASC 24 + 2) Insufficient Authentication
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 - (PCI 1.2) Requirement 4.1, Requirement 6.3.1.4, Requirement 6.5.9
[12] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 - (PCI 1.1) Requirement 4.1, Requirement 6.5.10
[13] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 - (PCI 2.0) Requirement 4.1, Requirement 6.5.4