Cookie missing HttpOnly (ARCH326)

Key dotnet.security.cookie-missing-http-only · Severity warning · Category security · CWE CWE-1004

Cookies without the HttpOnly flag are accessible to client-side JavaScript. In the presence of an XSS flaw, this lets attackers steal session cookies.

Incorrect

Response.Cookies.Append("auth", token, new CookieOptions
{
    Secure = true
});

Correct

Response.Cookies.Append("auth", token, new CookieOptions
{
    Secure = true,
    HttpOnly = true,
    SameSite = SameSiteMode.Strict
});

Fix

Set HttpOnly = true on session and auth cookies to block JavaScript access.