Cookie missing HttpOnly (ARCH2124)

Ce contenu n’est pas encore disponible dans votre langue.

Key python.security.cookie-missing-httponly · Severity warning · Category security · CWE CWE-1004

Session or auth cookies without the HttpOnly flag are readable by JavaScript. When an XSS flaw exists, these cookies can be stolen and the session hijacked.

Incorrect

resp = make_response("ok")
resp.set_cookie("session", token, secure=True, httponly=False)
return resp

Correct

resp = make_response("ok")
resp.set_cookie("session", token, secure=True, httponly=True, samesite="Lax")
return resp

Fix

Always set session and auth cookies with httponly=True.