'Analyze if a cookie value, sent in a HTTPS request, is now used for
identifying the user in an insecure page. Example:
Login is done over SSL
The rest of the page is HTTP'

def _ssl_cookie_via_http(self, request, response):

    if (request.get_url().get_protocol().lower() == 'https'):
        return
    request_dump = request.dump()
    for info_set in kb.kb.get(self, 'cookies'):
        for info in info_set.infos:
            if (info.get_url().get_protocol().lower() != 'https'):
                continue
            if (request.get_url().get_domain() != info.get_url().get_domain()):
                continue
            for cookie_key in info[COOKIE_KEYS]:
                cookie_value = info.get_cookie_object()[cookie_key].value
                if ((len(cookie_value) > 6) and (cookie_value in request_dump)):
                    desc = 'The    cookie    "%s"    with    value    "%s"    which    was    set    over    HTTPS,    was    then    sent    over    an    insecure    channel    in    a    request    to    "%s".'
                    desc %= (cookie_key, cookie_value, request.get_url())
                    v = CookieVuln('Secure    cookies    over    insecure    channel', desc, severity.HIGH, response.id, self.get_name())
                    v.set_url(response.get_url())
                    v.set_cookie_object(info.get_cookie_object())
                    kb.kb.append(self, 'secure_via_http', v)
