Insecure cookie (ARCH325)

Key dotnet.security.insecure-cookie · Severity warning · Category security · CWE CWE-614

Cookies without the Secure flag can be transmitted over unencrypted HTTP connections. This lets network eavesdroppers capture session cookies.

Incorrect

Response.Cookies.Append("session", token, new CookieOptions
{
    HttpOnly = true
});

Correct

Response.Cookies.Append("session", token, new CookieOptions
{
    HttpOnly = true,
    Secure = true,
    SameSite = SameSiteMode.Strict
});

Fix

Set Secure = true on all session and auth cookies, and enforce it globally via CookiePolicyOptions where possible.