mcp-server-semgrep/semgrep-rules/python/flask/security/audit/secure-set-cookie.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: secure-set-cookie
  patterns:
  - pattern-either:
    - pattern-inside: |
        $RESP = flask.make_response(...)
        ...
    - pattern-inside: |
        $RESP = flask.Response(...)
        ...
  - pattern-not: $RESP.set_cookie(..., secure=$A, httponly=$B, samesite=$C, ...)
  - pattern-not: $RESP.set_cookie(..., **$A)
  - pattern: $RESP.set_cookie(...)
  message: >-
    Found a Flask cookie with insecurely configured properties. 
    By default the secure, httponly and samesite ar configured insecurely.
    cookies should be handled securely by setting `secure=True`, `httponly=True`, and
    `samesite='Lax'` in response.set_cookie(...). If these parameters are not properly
    set, your cookies are not properly protected and are at risk of being stolen by
    an attacker. Include the `secure=True`, `httponly=True`, `samesite='Lax'` arguments
    or set these to be true in the Flask configuration.
  metadata:
    cwe:
    - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"
    owasp:
    - A05:2021 - Security Misconfiguration
    references:
    - https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie
    - https://flask.palletsprojects.com/en/3.0.x/security/#set-cookie-options
    category: security
    technology:
    - python
    - flask
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
    functional-categories:
    - web::search::cookie-config::flask
  languages: [python]
  severity: WARNING