AuthenticationCookieAllowsScriptAccess

warning native off by default

Group: Security

An authentication cookie without HttpOnly is available to scripts. Enable HttpOnly when the configured authentication policy requires it. This inspection is disabled by default because the intended policy or use can vary.

Example

<?php
setcookie("auth_token",$token,["secure"=>true,"httponly"=>false]);
setcookie("auth_token",$token,["secure"=>true,"HttpOnly"=>false]);
setcookie("auth_token",$token,time()+3600,"/","",true,false);

Reported:

• line 2: Enable HttpOnly for the authentication cookie.
• line 3: Enable HttpOnly for the authentication cookie.
• line 4: Enable HttpOnly for the authentication cookie.

Detection

• Resolved setcookie/setrawcookie has a configured authentication cookie name (default auth_token) and an explicit false httponly, given either in a literal options array or as the legacy positional/named httponly argument. Missing httponly is excluded in initial contract to avoid policy ambiguity.
  • Options array: the third argument is a literal array whose keys are all known. Option names are matched case-insensitively, as PHP does ("HttpOnly", "HTTPONLY"); when several spellings are present the element that comes last in array order decides.
  • Legacy argument: whenever the third argument is not a literal array, an explicit httponly argument decides, whatever the expiry expression is (0, time() + 3600, a variable, a call). PHP refuses to combine an options array with the legacy arguments, so their presence proves the legacy signature.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Options

Option	Type	Default	Effect
authenticationCookies	list	["auth_token"]	Names of the cookies that carry authentication; only these are checked.

Configure

In custos.json:

{
  "rules": {
    "AuthenticationCookieAllowsScriptAccess": {
      "enabled": true,
      "options": {
        "authenticationCookies": ["auth_token"]
      }
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore AuthenticationCookieAllowsScriptAccess