Ensure cookies have the secure flag

Docs > Code Analysis > Static Analysis Rules > Ensure cookies have the secure flag

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

ID: csharp-security/cookie-http-only

Language: C#

Severity: Warning

Category: Security

Description

Cookies must only be used for HTTP connections. Otherwise, client-side scripts can access cookies and compromise the user security.

Learn More

CWE-1004: Sensitive Cookie Without ‘HttpOnly’ Flag

Non-Compliant Code Examples

class MyClass {
    public static void setSecureCookie()
    {
        HttpCookie myCookie = new HttpCookie("my cookie");
        Console.WriteLine("Hello World");
        myCookie.HttpOnly = false;
    }
}

class MyClass {
    public static void setInsecureCookie()
    {
        HttpCookie myCookie = new HttpCookie("my cookie");
        Console.WriteLine("Hello World");
        myCookie.HttpOnly = false;
    }
}