no-cookie-auth-tokens

No Cookie Auth Tokens

⚠️ Security Issue

📋 Description

Authentication tokens (JWT, session tokens, bearer tokens) stored in cookies accessible via JavaScript are vulnerable to XSS attacks. Attackers can steal these tokens and impersonate users.

❌ Incorrect

// Setting auth token in cookie
document.cookie = 'authToken=' + token;

// JWT in cookie
document.cookie = `jwt=${response.token}; path=/`;

// Bearer token
document.cookie = 'bearer=' + bearerToken;

// Session ID
document.cookie = 'sessionId=' + session.id;

✅ Correct

// Set cookies server-side with HttpOnly flag
// Server (Express.js example):
res.cookie('authToken', token, {
  httpOnly: true,
  secure: true,
  sameSite: 'strict',
});

// Use non-sensitive cookies in JavaScript
document.cookie = 'theme=dark';
document.cookie = 'locale=en-US';

🛠️ Options

{
  "rules": {
    "browser-security/no-cookie-auth-tokens": [
      "error",
      {
        "allowInTests": true
      }
    ]
  }
}

bearerPatterns

Default: ["jwt", "token", "bearer", "auth", "authorization", "session", "sid", "credential", "credentials"]

Matched whole-word after the key is split on _, -, ., case boundaries and URL punctuation, and after regular plurals are folded — so token matches access_token and accessToken but not tokenizer, and auth matches auth_state but not author. A key that names a fact about a credential (tokenCount, sessionTimeout) is excluded separately.

This list used to live inside utils/sensitive-value-evidence.ts with no option surface at all, one level below the rules that report from it: a user whose credential cookie was called handle could not add it, and a user whose harmless key collided with the list could not remove it.

Keeping the partition. The five medium rules (no-sensitive-localstorage, no-sensitive-sessionstorage, no-sensitive-indexeddb, no-sensitive-data-in-cache, no-sensitive-cookie-js) defer to this rule with the SAME vocabulary, and they read the default because a rule cannot see another rule's options. If you customise bearerPatterns, mirror the change in those rules' sensitivePatterns — otherwise a key you added here is reported by this rule and by the medium rule that no longer defers.

Known False Negatives

The following patterns are not detected due to static analysis limitations:

Token Value from Variable

Why: Token patterns in variables not traced.

// ❌ NOT DETECTED - Token from variable
const value = jwt;
document.cookie = 'data=' + value;

Mitigation: Never set auth cookies client-side.

Dynamic Cookie Names

Why: Computed cookie names not analyzed.

// ❌ NOT DETECTED - Dynamic name
const key = 'authToken';
document.cookie = `${key}=${value}`;

Mitigation: Set auth cookies server-side with HttpOnly.

Cookie Library Wrappers

Why: Library methods not recognized.

// ❌ NOT DETECTED - Library wrapper
Cookies.set('token', jwt); // Uses document.cookie internally

Mitigation: Apply rule to library implementations.

📚 Related Resources

• MDN: HTTP Cookies
• OWASP: Session Management

Error Message Format

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

⚠️ CWE-1004 OWASP:A02 CVSS:5.3 | Sensitive Cookie Without HttpOnly detected | MEDIUM
   Fix: Review and apply the recommended fix | https://owasp.org/Top10/A02_2021/

Message Components