Non HTTP-only cookie for fiber sessions GO-S1039
Security
Major
a01
owasp top 10
A non HTTP-only cookie allows JavaScript on the page to read the session cookie, which may lead to session stealing in the case of an XSS.
Bad practice
package main
import (
"github.com/gofiber/fiber/v2"
"github.com/gofiber/fiber/v2/middleware/session"
)
func main() {
app := fiber.New()
sess := session.New(session.Config{CookieHTTPOnly: false})
app.Use(sess)
}
Recommended
package main
import (
"github.com/gofiber/fiber/v2"
"github.com/gofiber/fiber/v2/middleware/session"
)
func main() {
app := fiber.New()
sess := session.New(session.Config{CookieHTTPOnly: true})
app.Use(sess)
}