Insecure Cookie (ARCH6123)

Key ruby.security.insecure-cookie · Severity warning · Category security · CWE CWE-614

Cookies without the Secure flag can be sent over unencrypted HTTP and intercepted by network eavesdroppers. Always set Secure on sensitive cookies.

Incorrect

class SessionsController < ApplicationController
  def create
    cookies[:auth] = { value: token, httponly: true }
  end
end

Correct

class SessionsController < ApplicationController
  def create
    cookies[:auth] = {
      value: token,
      httponly: true,
      secure: true,
      same_site: :lax
    }
  end
end

Fix

Set sensitive cookies with secure: true so they are only transmitted over HTTPS.