phanalist

E0058: Cookie Missing Secure or HttpOnly

In plain English: A cookie without Secure can be sent over plain HTTP. A cookie without HttpOnly can be read by JavaScript. Session and authentication cookies should set both flags.

Why it matters: Without Secure, a cookie can leak over an insecure connection. Without HttpOnly, a cross-site scripting bug can steal the cookie.

Bad

setcookie('session', $id);
setcookie('session', $id, ['secure' => true]);
session_set_cookie_params(['httponly' => true]);

Good

setcookie('session', $id, [
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Lax',
]);

session_set_cookie_params([
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Lax',
]);

Secure means the browser only sends the cookie over HTTPS. HttpOnly means JavaScript cannot read it. SameSite controls when the browser sends the cookie with cross-site requests; Lax is a common default.

What the rule checks

• setcookie() and setrawcookie() with missing or disabled secure and httponly options
• session_set_cookie_params() with missing or disabled secure and httponly options
• Array options, positional arguments, and named arguments
• Array keys are matched case-insensitively, so both httponly and httpOnly are recognized

When it does not report

• Both flags are literal true.
• The options are non-literal, because the rule cannot prove a flag is absent.

How to fix

• Set secure => true and httponly => true.
• Add samesite => 'Lax' or 'Strict' where appropriate.
• Use array options instead of long positional argument lists.
• Use the session cookie configuration for session cookies.

Model limits

• Only literal arrays and literal boolean flags are inspected.
• SameSite is recommended but not required by this rule.

Configuration

E0058 has no configuration options and is enabled by default.

This site is open source. Improve this page.