Cookie Missing HttpOnly (ARCH8124)
Key kotlin.security.cookie-missing-httponly · Severity warning · Category security · CWE CWE-1004
Flags session / auth cookies created without isHttpOnly = true - readable by any script on the page.
Incorrect
Section titled “Incorrect”Cookie("auth", token).apply { secure = true }Correct
Section titled “Correct”Cookie("auth", token).apply { secure = true; isHttpOnly = true }Set isHttpOnly = true on cookies JavaScript has no business reading.