no-cookie-auth-tokens

// Setting auth token in cookie
document.cookie = 'authToken=' + token;

// JWT in cookie
document.cookie = `jwt=${response.token}; path=/`;

// Bearer token
document.cookie = 'bearer=' + bearerToken;

// Session ID
document.cookie = 'sessionId=' + session.id;

// Set cookies server-side with HttpOnly flag
// Server (Express.js example):
res.cookie('authToken', token, {
  httpOnly: true,
  secure: true,
  sameSite: 'strict',
});

// Use non-sensitive cookies in JavaScript
document.cookie = 'theme=dark';
document.cookie = 'locale=en-US';

{
  "rules": {
    "@interlace/browser-security/no-cookie-auth-tokens": [
      "error",
      {
        "allowInTests": true
      }
    ]
  }
}

// ❌ NOT DETECTED - Token from variable
const value = jwt;
document.cookie = 'data=' + value;

// ❌ NOT DETECTED - Dynamic name
const key = 'authToken';
document.cookie = `${key}=${value}`;

// ❌ NOT DETECTED - Library wrapper
Cookies.set('token', jwt); // Uses document.cookie internally

⚠️ CWE-1004 OWASP:A02 CVSS:5.3 | Sensitive Cookie Without HttpOnly detected | MEDIUM
   Fix: Review and apply the recommended fix | https://owasp.org/Top10/A02_2021/