Rule Definition
If read access is not properly restricted, then attackers can steal the sensitive information. If write access is not properly restricted, then attackers can modify and possibly delete the data, causing incorrect results and possibly a denial of service. The cookies with an overly broad path, such as the root context path ("/"), can be accessed by all web applications on the same domain name. A cookie with sensitive data, but with too broad a path, could hence be read and tampered by a less secure and untrusted application.

Remediation
Do not provide a root path

Violation Code Sample

angular.module('cookiesExample', ['ngCookies'])
.controller('ExampleController', ['$cookies', function($cookies) {

   let config = {
       path: '/'
   };

  // Setting a cookie
  $cookies.put('myFavorite', 'oatmeal',config);


}]);

Fixed Code Sample

angular.module('cookiesExample', ['ngCookies'])
.controller('ExampleController', ['$cookies', function($cookies) {

   let config = {
       path: '/admin'
   };

  // Setting a cookie
  $cookies.put('myFavorite', 'oatmeal',config);

}]);

https://docs.angularjs.org/api/ngCookies/service/$cookies https://cwe.mitre.org/data/definitions/287.html https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure