mcp-server-semgrep/semgrep-rules/go/gorilla/security/audit/session-cookie-missing-secure.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: session-cookie-missing-secure
  patterns:
  - pattern-not-inside: |
      &sessions.Options{
        ...,
        Secure: true,
        ...,
      }
  - pattern: |
      &sessions.Options{
        ...,
      }
  message: >-
    A session cookie was detected without setting the 'Secure' flag.
    The 'secure' flag for cookies prevents the client from transmitting
    the cookie over insecure channels such as HTTP. Set the 'Secure'
    flag by setting 'Secure' to 'true' in the Options struct.
  metadata:
    cwe:
    - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"
    owasp:
    - A05:2021 - Security Misconfiguration
    references:
    - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69
    category: security
    technology:
    - gorilla
    confidence: MEDIUM
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
  fix-regex:
    regex: (Secure\s*:\s+)false
    replacement: \1true
  severity: WARNING
  languages: [go]