no-sensitive-cookie-js

⚠️ CWE-1004 OWASP:A02 CVSS:5.3 | Sensitive Cookie Without HttpOnly detected | MEDIUM
   Fix: Review and apply the recommended fix | https://owasp.org/Top10/A02_2021/

// A secret in a cookie set from JavaScript
document.cookie = 'password=' + password;
document.cookie = `api_key=${key}; Secure; SameSite=Strict`;

// Even with security attributes, still readable by any script
document.cookie = 'client_secret=xyz; Secure; SameSite=Strict';

// Bearer credentials — token, jwt, sessionId, access_token, refreshToken —
// are reported by no-cookie-auth-tokens, not this rule:
document.cookie = 'access_token=' + accessToken;

// Non-sensitive cookies are fine
document.cookie = 'theme=dark';
document.cookie = 'locale=en-US';
document.cookie = 'visited=true';

// Set auth tokens via server response:
// Server: res.cookie('token', value, {
//   httpOnly: true,
//   secure: true,
//   sameSite: 'strict'
// });

// Or use fetch to get server-set HttpOnly cookie
await fetch('/api/auth/login', {
  method: 'POST',
  credentials: 'include',
  body: JSON.stringify({ username, password }),
});
// Server sets: Set-Cookie: token=xxx; HttpOnly; Secure; SameSite=Strict

{
  "browser-security/no-sensitive-cookie-js": [
    "error",
    {
      "allowInTests": true,
      "sensitivePatterns": [
        "token",
        "jwt",
        "session",
        "auth",
        "password",
        "secret",
        "api_key",
        "credential"
      ]
    }
  ]
}

[
  'password',
  'passwd',
  'pwd',
  'passphrase',
  'secret',
  'api key',
  'apikey',
  'private key',
  'secret key',
  'encryption key',
  'signing key',
  'client secret',
  'credit card',
  'card number',
  'cvv',
  'cvc',
  'ssn',
  'social security',
  'seed phrase',
  'mnemonic',
  'recovery code',
];

res.cookie('token', jwtToken, {
  httpOnly: true, // Prevents XSS access
  secure: true, // HTTPS only
  sameSite: 'strict', // CSRF protection
  maxAge: 3600000, // 1 hour
});

@Post('login')
login(@Res() res: Response) {
  res.cookie('token', jwtToken, {
    httpOnly: true,
    secure: true,
    sameSite: 'strict'
  });
}

// ❌ NOT DETECTED - Dynamic name
const name = 'authToken';
document.cookie = `${name}=${value}`;

// ❌ NOT DETECTED - Value from variable
const data = jwt;
document.cookie = 'data=' + data;

// ❌ NOT DETECTED - Library wrapper
js - cookie.set('token', jwt);