Cookie ‘HttpOnly’ attribute is not set to true — CodeQL query help documentation CodeQL docs

CodeQL resources

Cookie ‘HttpOnly’ attribute is not set to true¶

ID: go/cookie-httponly-not-set
Kind: path-problem
Security severity: 5.0
Severity: warning
Precision: high
Tags:
   - security
   - external/cwe/cwe-1004
Query suites:
   - go-code-scanning.qls
   - go-security-extended.qls
   - go-security-and-quality.qls

Click to see the query in the CodeQL repository

Cookies without the HttpOnly flag set are accessible to client-side scripts such as JavaScript running in the same origin. In case of a Cross-Site Scripting (XSS) vulnerability, the cookie can be stolen by a malicious script. If a sensitive cookie does not need to be accessed directly by client-side JS, the HttpOnly flag should be set.

Recommendation¶

Set the HttpOnly flag to true for authentication cookies to ensure they are not accessible to client-side scripts.

Example¶

In the following example, in the case marked BAD, the HttpOnly flag is not set, so the default value of false is used. In the case marked GOOD, the HttpOnly flag is set to true.

package main

import (
	"net/http"
)

func handlerBad(w http.ResponseWriter, r *http.Request) {
	c := http.Cookie{
		Name:  "session",
		Value: "secret",
	}
	http.SetCookie(w, &c) // BAD: The HttpOnly flag is set to false by default.
}

func handlerGood(w http.ResponseWriter, r *http.Request) {
	c := http.Cookie{
		Name:     "session",
		Value:    "secret",
		HttpOnly: true,
	}
	http.SetCookie(w, &c) // GOOD: The HttpOnly flag is set to true.
}

References¶

MDN: Set-Cookie Header.
PortSwigger: Cookie without HttpOnly flag set
Common Weakness Enumeration: CWE-1004.

© GitHub, Inc.
Terms
Privacy