攻撃者が操作できるCookie名またはセッション識別子

from fastapi import FastAPI, Request
from starlette.responses import Response

app = FastAPI()


@app.get("/set-session")
async def set_session(request: Request):
    response = Response("ok")
    response.set_cookie(
        key="session",
        value=request.query_params["sid"],  # 危険: 攻撃者が知っているセッション値
        secure=True,
        httponly=True,
        samesite="lax",
    )
    return response

from django.contrib.auth import authenticate, login
from django.http import HttpResponse


def sign_in(request):
    user = authenticate(
        request,
        username=request.POST["username"],
        password=request.POST["password"],
    )
    if user is None:
        return HttpResponse(status=401)

    login(request, user)  # Djangoがセッションキーを更新、または安全に置換
    return HttpResponse(status=204)

import os

from flask import Flask, abort, request, session

app = Flask(__name__)
app.config.from_mapping(
    SECRET_KEY=os.environ["FLASK_SECRET_KEY"],
    SESSION_COOKIE_SECURE=True,
    SESSION_COOKIE_HTTPONLY=True,
    SESSION_COOKIE_SAMESITE="Lax",
)


@app.post("/login")
def sign_in():
    user = verify_credentials(
        request.form["username"],
        request.form["password"],
    )
    if user is None:
        abort(401)

    session.clear()  # 認証前の状態を削除
    session["user_id"] = user.id
    return {"status": "ok"}

from flask import Flask, make_response, request

app = Flask(__name__)


@app.get("/set-cookie")
def set_cookie():
    response = make_response("ok")
    response.set_cookie(request.args["name"], "1")  # 危険: 動的なCookie名
    return response

from django.http import HttpResponse


def set_raw_cookie(request):
    response = HttpResponse("ok")
    response.headers["Set-Cookie"] = request.GET["raw"]  # 危険: ヘッダー全体を直接設定
    return response

from flask import make_response, request
from werkzeug.http import dump_cookie


def unsafe_cookie_defaults():
    names = {"theme": "theme", "locale": "locale"}
    response = make_response("ok")
    name = names.get("unknown", request.args["name"])
    response.set_cookie(name, "light")  # 危険: 既定値が定数の対応表にないリクエスト値
    response.headers["Set-Cookie"] = dump_cookie(
        "__Host-session", request.args["sid"], secure=True, path="/"
    )  # 危険: シリアル化してもセッションIDは攻撃者が選択
    return response

from fastapi import HTTPException, Request
from starlette.responses import Response


async def save_theme(request: Request):
    theme = request.query_params.get("theme", "light")
    if theme not in {"light", "dark"}:
        raise HTTPException(status_code=400)

    response = Response("saved")
    response.set_cookie(
        key="theme",
        value=theme,
        secure=True,
        samesite="lax",
    )
    return response

from flask import make_response, request
from werkzeug.http import dump_cookie


def save_preference():
    names = {"theme": "theme", "locale": "locale"}
    name = names.get(request.args["kind"], "theme")
    response = make_response("ok")
    response.set_cookie(name, "light")
    response.headers["Set-Cookie"] = dump_cookie("locale", request.args["locale"])
    return response