Description

Detects when cookies are configured without the HttpOnly flag set, which could allow malicious JavaScript to access sensitive cookie data. This vulnerability increases the risk of session hijacking through Cross-Site Scripting (XSS) attacks since client-side scripts can read cookie values.

Detection Strategy

• Identifies cookie-related method calls in JavaScript code that set or configure cookies

• Examines the cookie configuration parameters to check if HttpOnly flag is missing

• Reports a vulnerability when a cookie is configured without explicitly setting the HttpOnly flag to true

• Focuses on cookie setting operations that end with specific method patterns defined in METHOD_SINKS

• Validates both the cookie name and configuration arguments to ensure accurate detection

Vulnerable code example

import express from 'express';
const app = express();

app.get('/login', (req, res) => {
  // Vulnerable: Setting cookie without HttpOnly flag exposes it to XSS attacks
  res.setHeader('Set-Cookie', 'token=abc123; Path=/; Secure; SameSite=Lax');
  res.send('Cookie set');
});

✅ Secure code example

import express from 'express';
const app = express();

app.get('/login', (req, res) => {
  // Secure: HttpOnly flag prevents JavaScript access to cookie
  res.setHeader('Set-Cookie', 'token=abc123; Path=/; Secure; HttpOnly; SameSite=Lax');
  res.send('Cookie set');
});