Rule Definition
If read access is not properly restricted, then attackers can steal the sensitive information. If write access is not properly restricted, then attackers can modify and possibly delete the data, causing incorrect results and possibly a denial of service.

Remediation
Do not provide a root path

Violation Code Sample

// require
var Vue = require('vue')
Vue.use(require('vue-cookies'))

// es2015 module
import Vue from 'vue'
import VueCookies from 'vue-cookies'
Vue.use(VueCookies)

// set global cookie
Vue.$cookies.set('hover-time','1s');

// set local cookie

// name, time, path, domain, secure
this.$cookies.set("token","1s","/",".domain.com",false); //violation

// or

this.$cookies.set("token","1s","/",".domain.com"); //violation

Fixed Code Sample

// require
var Vue = require('vue')
Vue.use(require('vue-cookies'))

// es2015 module
import Vue from 'vue'
import VueCookies from 'vue-cookies'
Vue.use(VueCookies)

// set global cookie
Vue.$cookies.set('hover-time','1s');

// set local cookie

// name, time, path, domain, secure
this.$cookies.set("token","1s","/path","sub.domain.com",true); // no violation

https://www.npmjs.com/package/vue-cookies https://cwe.mitre.org/data/definitions/287.html https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure