Cookie missing HttpOnly (ARCH2124)

Esta página aún no está disponible en tu idioma.

Key python.security.cookie-missing-httponly · Severity warning · Category security · CWE CWE-1004

Session or auth cookies without the HttpOnly flag are readable by JavaScript. When an XSS flaw exists, these cookies can be stolen and the session hijacked.

Incorrect

resp = make_response("ok")
resp.set_cookie("session", token, secure=True, httponly=False)
return resp

Correct

resp = make_response("ok")
resp.set_cookie("session", token, secure=True, httponly=True, samesite="Lax")
return resp

Fix

Always set session and auth cookies with httponly=True.