Insecure Cookie (ARCH5123)

Key go.security.insecure-cookie · Severity warning · Category security · CWE CWE-614

Cookies without the Secure flag are also sent over unencrypted HTTP connections. This lets a network attacker capture the session cookie in cleartext.

Incorrect

http.SetCookie(w, &http.Cookie{
    Name:     "session",
    Value:    token,
    HttpOnly: true,
})

Correct

http.SetCookie(w, &http.Cookie{
    Name:     "session",
    Value:    token,
    HttpOnly: true,
    Secure:   true,
    SameSite: http.SameSiteLaxMode,
})

Fix

Set sensitive cookies with Secure: true so they are only transmitted over HTTPS.