C#

C#

By DeepSource

Audit required: Cookie is accessible through a client-side script CS-A1010

Security

Setting HttpOnly to true means that the cookie cannot be accessed through a client-side script and is limited to the ASP.NET engine. Because cookies can be used to preserve and store critical information that maybe potentially related to the user session, it is always recommended that you limit the scope as and where necessary to prevent any unintended access and cookie-theft. You can however ignore this warning if you're absolutely sure that the cookie does not contain any critical information.

Examples

Bad Practice

cookie.HttpOnly = false;

Recommended

cookie.HttpOnly = true;

Reference