search

pumasecurity / puma-scan

Puma Scan is a software security Visual Studio extension that provides real time, continuous source code analysis as development teams write code. Vulnerabilities are immediately displayed in the development environment as spell check and compiler warnings, preventing security bugs from entering your applications.
https://www.pumascan.com
Mozilla Public License 2.0
447 stars 79 forks source link

New Rule: Cookie Security #50

Open ejohn20 opened 6 years ago

ejohn20 commented 6 years ago

Puma Scan didn’t detect missing HttpOnly and Secure flags here.

Secure settings are Secure = true, HttpOnly = true, and Expires can only be set to a past date.

HttpCookie CreateCookie(string value)
{
      var ck = new HttpCookie(COOKIE_NAME, value);
      if (string.IsNullOrWhiteSpace(value)) ck.Expires = DateTime.Now.AddYears(-1);
      return ck;
}

or

```cs
Response.SetCookie(new HttpCookie("sid", sid) { Expires = DateTime.Now.AddDays(1) });
ejohn20 commented 5 years ago

Here's another sink in .NET Core

CookieOptions options = new CookieOptions() {
   HttpOnly = true,
   Secure = true,
   SameSite = SameSiteMode.Strict,
};