<!DOCTYPE qhelp PUBLIC

"-//Semmle//qhelp//EN"

"qhelp.dtd">

<qhelp>

<overview>

<p>Cookies without the <code>HttpOnly</code> flag set are accessible to client-side scripts such as JavaScript running in the same origin.

In case of a Cross-Site Scripting (XSS) vulnerability, the cookie can be stolen by a malicious script.

If a sensitive cookie does not need to be accessed directly by client-side JS, the <code>HttpOnly</code> flag should be set.</p>

</overview>

<recommendation>

<p>

Set the <code>HttpOnly</code> flag to <code>true</code> for authentication cookies to ensure they are not accessible to client-side scripts.

</p>

</recommendation>

<example>

<p>

In the following example, in the case marked BAD, the <code>HttpOnly</code> flag is not set, so the default value of <code>false</code> is used.

In the case marked GOOD, the <code>HttpOnly</code> flag is set to <code>true</code>.

</p>

<sample src="examples/CookieWithoutHttpOnly.go"/>

</example>

<references>

<li>MDN: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie">Set-Cookie</a> Header.</li>

<li>PortSwigger: <a href="https://portswigger.net/kb/issues/00500600_cookie-without-httponly-flag-set">Cookie without HttpOnly flag set</a></li>

</references>

</qhelp>