vetkit.php.cookie.insecure-flags
A cookie or the session cookie is configured with the Secure or HttpOnly flag explicitly disabled. It may travel over plain HTTP or be read by injected JavaScript.
Last updated:
Suite: Security
php
A cookie or the session cookie is configured with the Secure or HttpOnly flag explicitly disabled. It may travel over plain HTTP or be read by injected JavaScript.
Category: SECURITY · Engine rule severity: INFO
How to fix it
Set secure => true and httponly => true (and samesite => 'Lax') for session and authentication cookies.
References
Source: packages/engine/rules/sast/php.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.