Zennoxa Shield
Rules / JavaScript / TypeScript
SHIELD-JS-022

Cookie set without HttpOnly/Secure flags

mediumJavaScript / TypeScriptCWE-1004CVSS 5.3

What it detects

A session/auth cookie without httpOnly is readable by XSS; without secure it is sent over plaintext HTTP.

How to fix

Set httpOnly, secure and sameSite flags on session/auth cookies (res.cookie(name, val, { httpOnly: true, secure: true })).

Vulnerable — Shield flags thissession.js
const express = require('express');
const app = express();

app.get('/login', (req, res) => {
  res.cookie('session', 'abc123token');
  res.send('ok');
});
Fixed — scans cleansession.js
const express = require('express');
const app = express();

app.get('/login', (req, res) => {
  res.cookie('session', 'abc123token', { httpOnly: true, secure: true, sameSite: 'strict' });
  res.send('ok');
});

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-022, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-022: Cookie set without HttpOnly/Secure flags — Zennoxa Shield