Cookie Missing HttpOnly (ARCH6124)

Key ruby.security.cookie-missing-httponly · Severity warning · Category security · CWE CWE-1004

Cookies without the HttpOnly flag are readable by JavaScript, so an XSS flaw can steal them. Always set HttpOnly on session and auth cookies.

Incorrect

class SessionsController < ApplicationController
  def create
    cookies[:session_token] = { value: token }
  end
end

Correct

class SessionsController < ApplicationController
  def create
    cookies[:session_token] = {
      value: token,
      httponly: true,
      secure: true,
      same_site: :lax
    }
  end
end

Fix

Set session and auth cookies with httponly: true.