Description

This detector identifies Rust web applications using the Actix framework that create HTTP cookies without the HttpOnly flag set. The HttpOnly flag prevents client-side JavaScript from accessing cookies, which helps protect against Cross-Site Scripting (XSS) attacks that attempt to steal session tokens or other sensitive cookie data.

Detection Strategy

• Scans Rust source code for Actix web framework cookie creation patterns

• Identifies cookie configuration code that lacks the .http_only(true) method call

• Checks for missing cookie_http_only session flag configurations

• Reports vulnerabilities when cookies are created without proper HttpOnly security flags

Vulnerable code example

use actix_web::cookie::Cookie;
use actix_web::{HttpResponse, Responder};

async fn login(token: String) -> impl Responder {
    // VULNERABLE: Cookie lacks .http_only(true) - accessible to JavaScript
    HttpResponse::Ok()
        .cookie(Cookie::build("session_id", token).secure(true).finish())
        .finish()...

✅ Secure code example

use actix_web::cookie::Cookie;
use actix_web::{HttpResponse, Responder};

async fn login(token: String) -> impl Responder {
    // SAFE: Cookie has .http_only(true) - protected from JavaScript access
    HttpResponse::Ok()
        .cookie(Cookie::build("session_id", token).secure(true).http_only(true).finish())
        .finish()...