SH106: Session cookies not hardened

Severity: medium · Category: authentication · Applies to: aspnet, django, fastapi, flask, spring

Why it matters

Cookies without the Secure flag travel over plain HTTP, and cookies without HttpOnly can be read by injected scripts, so a single XSS bug or open network leaks sessions.

How to fix

Enable the Secure and HttpOnly flags for session and CSRF cookies.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH106

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH106