SH104: Laravel session cookie not hardened

Severity: medium · Category: authentication · Applies to: laravel

Why it matters

Session cookies without secure, http_only and same_site can be sent over HTTP, read by scripts, or attached to cross-site requests.

How to fix

In config/session.php set secure=true, http_only=true and same_site='lax'.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH104

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH104