Cookie Missing HttpOnly (ARCH4124)

Key java.security.cookie-missing-httponly · Severity warning · Category security · CWE CWE-1004

Session cookies without the HttpOnly flag are readable by JavaScript, allowing cookie theft via XSS. Always mark auth cookies HttpOnly.

Incorrect

Cookie cookie = new Cookie("SESSION", token);
cookie.setSecure(true);
response.addCookie(cookie); // no HttpOnly -> JS can read it

Correct

Cookie cookie = new Cookie("SESSION", token);
cookie.setHttpOnly(true);
cookie.setSecure(true);
response.addCookie(cookie);

Fix

Call setHttpOnly(true) on session/auth cookies.