Source kernel · Security

Auth cookie readable by page scripts

rust_doctor::source::insecure_auth_cookie

Keep http_only(true) on a session or auth cookie so page scripts cannot read it; expose to JavaScript only a value that grants nothing, such as a CSRF token.

Category: Security
Default level: warn
Tier: P1
Producer: Source kernel
Diff scope: item

Not a defect when

The cookie carries no credential, only a value the frontend must read such as a CSRF token or a display preference, despite a name that sounds like auth.

Crates it waits for

It runs only where at least one of these crates is resolved, and every one resolved sits in the range it was validated on:

cookie *

What it reads

Source text, without resolving types or expanding macros.

Tier

Serious: worth interrupting other work for.

The tier bounds how severe a rule may be; its category bounds the tier.

Diff scope

The function or item around the changed line.

What --scope contextual looks at to decide whether a change caused the finding.

Change it

Turn it off, or make it blocking, without touching the code it flags:

rust-doctor --rule rust_doctor::source::insecure_auth_cookie=off .
rust-doctor --rule rust_doctor::source::insecure_auth_cookie=error .