mcp-server-semgrep/semgrep-rules/scala/play/security/conf-insecure-cookie-settings.conf

MCP Server for Semgrep Integration - static code analysis with AI

# This is the main configuration file for the application.
# ~~~~~

# Secret key
# ~~~~~
# The secret key is used to secure cryptographics functions.
play.http.secret.key = "changeme"

# The application languages
# ~~~~~
play.i18n.langs = [ "en" ]

# Disable default filters
play.filters.enabled = [ ]

play.modules {
  enabled += "startup.StartupModule"
}

play.server.server-header = "Play2"

# Session configuration
session = {

  cookieName = "PLAY_SESSION"
  
  maxAge = null

  httpOnly = true

  sameSite = "lax"

  domain = null

  path = ${play.http.context}

  # ruleid: conf-insecure-cookie-settings
  secure = false

  jwt {
    signatureAlgorithm = "HS256"

    expiresAfter = ${play.http.session.maxAge}

    clockSkew = 5 minutes

    dataClaim = "data"
  }
}

# Session configuration 2
session = {

  cookieName = "PLAY_SESSION"
  
  maxAge = null

  httpOnly = true

  sameSite = "lax"

  domain = null

  path = ${play.http.context}

  # ok: conf-insecure-cookie-settings
  secure = true

  jwt {
    signatureAlgorithm = "HS256"

    expiresAfter = ${play.http.session.maxAge}

    clockSkew = 5 minutes

    dataClaim = "data"
  }
}