Cookie missing HttpOnly (ARCH3124)

Ce contenu n’est pas encore disponible dans votre langue.

Key typescript.security.cookie-missing-httponly · Severity warning · Category security · CWE CWE-1004

Session/auth cookies set without the HttpOnly flag are readable by JavaScript and can be stolen through an XSS flaw. Always mark sensitive cookies HttpOnly.

Incorrect

res.cookie("session", token, { secure: true });

Correct

res.cookie("session", token, {
  httpOnly: true,
  secure: true,
  sameSite: "strict",
});

Fix

Set session and auth cookies with httpOnly: true to block client-side script access.