A cookie is created with HttpOnly = false, making it readable from client-side JavaScript.

Why this matters

If the site has any XSS, an injected script can read the auth/session cookie via document.cookie and exfiltrate the session (CWE-1004). This is a common AI-generated change made so JS can "see" the cookie, which needlessly removes a key defense.

Set HttpOnly = true on authentication and session cookies so they are not exposed to scripts. If the browser must read a value, keep it in a separate non-sensitive cookie rather than weakening the session cookie.

using Microsoft.AspNetCore.Http;

public class SessionController
{
    public void WriteSession(HttpResponse response, string token)
    {
        response.Cookies.Append("session", token, new CookieOptions
        {
            Secure = true,
            // ruleid: auth.csharp.cookie.httponly-false
            HttpOnly = false,
        });
    }
}

using Microsoft.AspNetCore.Http;

public class SessionController
{
    public void WriteSession(HttpResponse response, string token)
    {
        response.Cookies.Append("session", token, new CookieOptions
        {
            Secure = true,
            HttpOnly = true,
        });
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.csharp.cookie.httponly-false -- <reason>

References