Cookie Missing HttpOnly (ARCH7124)

Key php.security.cookie-missing-httponly · Severity warning · Category security · CWE CWE-1004

Session/auth cookies without the HttpOnly flag are readable by JavaScript. If an XSS flaw exists, an attacker can steal the session via document.cookie.

Incorrect

<?php
setcookie('session', $token, [
    'secure' => true,
    'httponly' => false, // readable by JavaScript
]);

Correct

<?php
setcookie('session', $token, [
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Lax',
]);

Fix

Set all session and auth cookies with httponly => true so client scripts cannot access them.