Cookie Missing HttpOnly (ARCH9124)
Key swift.security.cookie-missing-httponly · Severity warning · Category security · CWE CWE-1004
Flags session / auth cookies created with isHTTPOnly: false.
Incorrect
Section titled “Incorrect”HTTPCookies.Value(string: token, isSecure: true, isHTTPOnly: false)Correct
Section titled “Correct”HTTPCookies.Value(string: token, isSecure: true, isHTTPOnly: true)Set isHTTPOnly: true on cookies JavaScript has no business reading.