Cookie Missing HttpOnly (ARCH5124)

Key go.security.cookie-missing-httponly · Severity warning · Category security · CWE CWE-1004

Session or auth cookies without the HttpOnly flag are readable by JavaScript. This makes them stealable via XSS if the application has a cross-site scripting flaw.

Incorrect

http.SetCookie(w, &http.Cookie{
    Name:  "session",
    Value: token,
})

Correct

http.SetCookie(w, &http.Cookie{
    Name:     "session",
    Value:    token,
    HttpOnly: true,
    Secure:   true,
})

Fix

Set session and auth cookies with HttpOnly: true to block JavaScript access.