Cookie missing HttpOnly (ARCH3124)

Esta página aún no está disponible en tu idioma.

Key typescript.security.cookie-missing-httponly · Severity warning · Category security · CWE CWE-1004

Session/auth cookies set without the HttpOnly flag are readable by JavaScript and can be stolen through an XSS flaw. Always mark sensitive cookies HttpOnly.

Incorrect

res.cookie("session", token, { secure: true });

Correct

res.cookie("session", token, {
  httpOnly: true,
  secure: true,
  sameSite: "strict",
});

Fix

Set session and auth cookies with httpOnly: true to block client-side script access.