mcp-server-semgrep/semgrep-rules/scala/play/security/conf-insecure-cookie-settings.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: conf-insecure-cookie-settings
  patterns:
  - pattern: secure = false
  - pattern-inside: |
      session = {
        ...
      }
  message: >-
    Session cookie `Secure` flag is explicitly disabled.
    The `secure` flag for cookies prevents the client from transmitting
    the cookie over insecure channels such as HTTP. Set the `Secure`
    flag by setting `secure` to `true` in configuration file.
  languages:
  - generic
  severity: WARNING
  paths:
    include:
    - '*.conf'
  metadata:
    category: security
    references:
    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security
    - https://www.playframework.com/documentation/2.8.x/SettingsSession#Session-Configuration
    technology:
    - play
    - scala
    cwe:
    - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"
    owasp:
    - A05:2021 - Security Misconfiguration
    confidence: MEDIUM
    subcategory:
    - vuln
    likelihood: LOW
    impact: LOW