mcp-server-semgrep/semgrep-rules/go/lang/security/audit/net/cookie-missing-httponly.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: cookie-missing-httponly
  patterns:
  - pattern-not-inside: |
      http.Cookie{
        ...,
        HttpOnly: true,
        ...,
      }
  - pattern: |
      http.Cookie{
        ...,
      }
  message: >-
    A session cookie was detected without setting the 'HttpOnly' flag.
    The 'HttpOnly' flag for cookies instructs the browser to forbid
    client-side scripts from reading the cookie which mitigates XSS
    attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true'
    in the Cookie.
  metadata:
    cwe:
    - "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag"
    owasp:
    - A05:2021 - Security Misconfiguration
    references:
    - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/util/cookie.go
    - https://golang.org/src/net/http/cookie.go
    category: security
    technology:
    - go
    confidence: MEDIUM
    subcategory:
    - vuln
    likelihood: LOW
    impact: LOW
  fix-regex:
    regex: (HttpOnly\s*:\s+)false
    replacement: \1true
  severity: WARNING
  languages: [go]