Skip to content
HoundDog.ai Docs

Sensitive Data Exposure in Cookies in Plaintext

Issue

Section titled “Issue”

Sensitive data exposure in cookies in plaintext

Impacted Frameworks and Reasons

Section titled “Impacted Frameworks and Reasons”

GDPR (Articles 5 and 32)

Section titled “GDPR (Articles 5 and 32)”

  • Article 5 requires data minimization, purpose limitation, and integrity. Storing personal data in cookies in plaintext increases the risk of unauthorized access and violates these principles.

  • Article 32 requires appropriate technical and organizational security measures. Cookies accessible to client side scripts or external domains weaken confidentiality controls.

CCPA and CPRA

Section titled “CCPA and CPRA”

  • Requires transparency and control over how personal data is shared and used.

  • If cookies expose personal data to analytics, advertising, or third party services without proper notice or opt out options, this is considered unauthorized sharing.

HIPAA

Section titled “HIPAA”

  • PHI must be protected and restricted to authorized entities.

  • Storing PHI in cookies in plaintext makes it easily accessible to the browser, third party libraries, or network logs, resulting in an unauthorized disclosure.

PCI

Section titled “PCI”

  • Cardholder data must never be stored in plaintext in a client side storage location.

  • Cookies containing cardholder data directly violate PCI storage and transmission requirements.

GLBA

Section titled “GLBA”

  • Requires safeguards to protect customer financial information.

  • Cookies with sensitive financial data increase exposure risk and show insufficient security controls.

PIPEDA

Section titled “PIPEDA”

  • Requires secure handling and informed consent for personal data.

  • Sensitive data in cookies without clear disclosure or protection breaks responsible handling requirements.

APPI

Section titled “APPI”

  • Requires purpose limitation and confidentiality protections.

  • Plaintext cookies undermine confidentiality and may violate restrictions on external disclosure.

NIST 800 53

Section titled “NIST 800 53”

  • Emphasizes secure storage, access control, and confidentiality of sensitive information.

  • Plaintext cookies are vulnerable to interception and client side access, weakening confidentiality controls.

ISO IEC 29100

Section titled “ISO IEC 29100”

  • Requires accountability, transparency, and strong data protection measures.

  • Storing sensitive data in cookies in plaintext lacks adequate safeguards.

KSA PDPL

Section titled “KSA PDPL”

  • Requires lawful processing and safeguards to prevent unauthorized disclosure.

  • Cookies accessible to untrusted code or domains increase unauthorized disclosure risk.

UAE PDPL

Section titled “UAE PDPL”

  • Processing must remain properly protected and aligned with declared purpose.

  • Plaintext cookies risk unintended processing and access.

Qatar PDPPL

Section titled “Qatar PDPPL”

  • Requires measures to prevent unauthorized access or disclosure.

  • Storing sensitive data in cookies in plaintext increases the likelihood of exposure.

CWE and OWASP

Section titled “CWE and OWASP”

This risk maps to CWE-315: Cleartext Storage of Sensitive Information in a Cookie and CWE-539: Use of Persistent Cookies Containing Sensitive Information, and to OWASP Top 10 A04:2021 – Insecure Design.

Section titled “Recommended Remediation”

Avoid storing sensitive data in cookies wherever possible. Use session identifiers or tokens that reference secure server side data instead of embedding sensitive values directly. Document and enforce data handling rules that prohibit plaintext cookie storage.