Insecure cookie (ARCH2123)

Key python.security.insecure-cookie · Severity warning · Category security · CWE CWE-614

Cookies without the Secure flag are also sent over unencrypted HTTP connections. This lets sensitive session cookies be captured in cleartext on the network.

Incorrect

resp = make_response("ok")
resp.set_cookie("session", token, httponly=True, secure=False)
return resp

Correct

resp = make_response("ok")
resp.set_cookie("session", token, httponly=True, secure=True, samesite="Lax")
return resp

Fix

Always set sensitive cookies with secure=True so they are sent only over HTTPS.