Rule Definition
Cross-site scripting attacks often access cookies in an attempt to steal session identifiers or authentication tokens. This is why all major browsers support the HttpOnly cookie property that prevents client-side scripts from accessing the cookie. When HttpOnly is not enabled, attackers may more easily access user cookies.

Remediation
Always set httpOnly option when creating a cookie

Violation Code Sample

setcookie("user", "John Doe", time() + (86400 * 30), "", "", true, false);

Fixed Code Sample

setcookie("user", "John Doe", time() + (86400 * 30), "", "", true, true);

CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag https://cwe.mitre.org/data/definitions/1004.html OWASP Top Ten 2017 - A3:2017-Sensitive Data Exposure https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration https://owasp.org/Top10/A05_2021-Security_Misconfiguration/ Session Management Cheat Sheet - Session Management Cheat Sheet https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#httponly-attribute