Cookie set without its protective attributes

A cookie is written without `httpOnly`, `secure`, or `sameSite`. Missing `httpOnly` turns any cross-site scripting bug into session theft; missing `secure` sends the cookie over plain HTTP; missing `sameSite` attaches it to cross-site requests. A cookie holding no sensitive value may not need all three, which is why the finding names the ones it did not find rather than assuming the worst.

medium likely application source OWASP A05:2021 / CWE-614

What it looks like

MEDIUM possible Cookie set without its protective attributes A05:2021 app/api/login/route.ts:20:3 18 │ 19 │ // insecure-cookie: Next's cookies().set with no attributes. 20 │ cookies().set('session', rows.rows[0]?.id ?? 'anon') │ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cookie written without httpOnly/secure/sameSite 21 │ 22 │ return NextResponse.json({ ok: true })

From app/api/login/route.ts in the fixture suite. The fixture test asserts this finding.

How to fix it

Set httpOnly, secure, and sameSite when writing a cookie that carries anything the user would not want read or replayed.

The fix for your framework

Choose the API used by your project.

Check your own repository

npx owlwarden scan --preset deep
npx owlwarden explain insecure-cookie

explain prints the rule and fixes in the terminal. It does not use the network.

All 25 rules / owlwarden