Insecure Cookie (ARCH7123)

Key php.security.insecure-cookie · Severity warning · Category security · CWE CWE-614

Cookies without the Secure flag (or with SameSite=None and no Secure) are also sent over unencrypted HTTP, so an attacker eavesdropping on the network can capture the session cookie.

Incorrect

<?php
setcookie('session', $token, [
    'httponly' => true,
    'secure' => false, // also sent over HTTP
]);

Correct

<?php
setcookie('session', $token, [
    'httponly' => true,
    'secure' => true, // HTTPS only
    'samesite' => 'Lax',
]);

Fix

Set all session cookies with secure => true so they are only transmitted over an encrypted connection.