v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: HIGH auth.php.cookie.insecure-flags

An authentication-related cookie is set without the Secure and/or HttpOnly flags (or with SameSite=None).

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

HttpOnly=false exposes the cookie to JavaScript so an XSS bug can steal the session; Secure=false lets it travel over plain HTTP where a network attacker can read it; SameSite=None (without an allowlist) sends it on cross-site requests (CWE-1004). AI-generated snippets pass false for these flags to avoid a "cookie not set" issue during local testing and it ships to production.

Set the security flags on session/auth cookies: setcookie('session_id', $v, ['secure' => true, 'httponly' => true, 'samesite' => 'Lax']); session_set_cookie_params(['lifetime' => 3600, 'secure' => true, 'httponly' => true, 'samesite' => 'Lax']);

VULNERABLE
vulnerable.php
<?php

function set_positional($v)
{
    // ruleid: auth.php.cookie.insecure-flags
    setcookie('session_id', $v, time() + 3600, '/', '', true, false);
}

function set_positional_zero($v)
{
    // ruleid: auth.php.cookie.insecure-flags
    setcookie('auth_token', $v, 0, '/', '', true, 0);
}

function set_array_httponly($v)
{
    // ruleid: auth.php.cookie.insecure-flags
    setcookie('sid', $v, ['expires' => 0, 'httponly' => false, 'secure' => true]);
}

function set_array_secure($v)
{
    // ruleid: auth.php.cookie.insecure-flags
    setcookie('remember_me', $v, ['secure' => false, 'httponly' => true]);
}

function set_array_samesite($v)
{
    // ruleid: auth.php.cookie.insecure-flags
    setcookie('csrf_token', $v, ['samesite' => 'None', 'secure' => true]);
}

function set_session_params()
{
    // ruleid: auth.php.cookie.insecure-flags
    session_set_cookie_params(3600, '/', '', false, false);
}
SAFE
safe.php
<?php

function set_positional_secure($v)
{
    // ok: Secure and HttpOnly both enabled
    setcookie('session_id', $v, time() + 3600, '/', '', true, true);
}

function set_array_secure($v)
{
    // ok: secure, httponly and a strict same-site policy
    setcookie('sid', $v, ['secure' => true, 'httponly' => true, 'samesite' => 'Lax']);
}

function set_session_params()
{
    // ok: secure and httponly enabled
    session_set_cookie_params(3600, '/', '', true, true);
}

function set_non_auth_cookie($v)
{
    // ok: not an auth-related cookie name
    setcookie('theme', $v, 0, '/', '', true, false);
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.php.cookie.insecure-flags -- <reason>

References

https://www.php.net/manual/en/function.setcookie.php ↗https://cwe.mitre.org/data/definitions/1004.html ↗