CVE-2026-58508: Go Insecure Csrf Cookiecve-2026-58508-go-insecure-csrf-cookie
CSRF token cookies should have HttpOnly set to true to prevent client-side script access and token exposure.
Explore
Rule Explorer
Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
- Public rules
- 4797
- Downloads
- 7.4M
- Verified
- 4797
- Authors
- 2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
CVE-2026-28737: Go Net Http Cookie Httponly Falsecve-2026-28737-go-net-http-cookie-httponly-false
HTTP cookie is created with HttpOnly set to false. Sensitive cookies such as CSRF tokens or session identifiers must have HttpOnly set to true to prevent client-side JavaScript from reading cookie contents in the event of XSS.
CVE-2026-22547: Generic Insecure Csrf Cookie Httponlycve-2026-22547-generic-insecure-csrf-cookie-httponly
A cookie used for CSRF protection has a configurable or disabled HttpOnly flag. This might allow an attacker to extract the token via XSS or sandboxed iframes unless a Double Submit Cookie pattern mandates JS access.
CVE-2025-40843: Python Http Server Insecure Cookiecve-2025-40843-python-http-server-insecure-cookie
The application sets a cookie using `send_header` without enforcing 'HttpOnly' or 'SameSite' attributes. This can leave the application vulnerable to Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). Always ensure sensitive cookies are protected with 'HttpOnly', 'SameSite', and 'Secure' flags.
Cookie CookieHTTPOnlygitlab-sast-rules-lgpl-kotlin-cookie-rule-cookiehttponly
A new cookie is created without the HttpOnly flag set. The HttpOnly flag is a directive to the browser to make sure that the cookie can not be red by malicious script. When a user is the target of a "Cross-Site Scripting", the attacker would benefit greatly from getting the session id for example.
KotlinCWE-1004Headers Cookie Session No Httponlygitlab-sast-rules-lgpl-javascript-headers-rule-cookie-session-no-httponly
'Session middleware settings: `httpOnly` is explicitly set to false. It ensures that sensitive cookies cannot be accessed by client side JavaScript and helps to protect against cross-site scripting attacks.'
JSCWE-1004Cookie CookieHTTPOnlygitlab-sast-scala-cookie-rule-cookiehttponly
A new cookie is created without the HttpOnly flag set. The HttpOnly flag is a directive to the browser to make sure that the cookie can not be red by malicious script. When a user is the target of a "Cross-Site Scripting", the attacker would benefit greatly from getting the session id for example.
ScalaCWE-1004Cookies CookieWithoutHttpOnlyFlaggitlab-sast-csharp-cookies-rule-cookiewithouthttponlyflag
The `HttpOnly` attribute when set to `true` protects the cookie value from being accessed by client side JavaScript such as reading the `document.cookie` values. By enabling this protection, a website that is vulnerable to Cross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie value from JavaScript. Example of protecting
C#CWE-1004All matching rules loaded.