HostCookiePrefixContractViolation

warning native on by default

Group: Security

A __Host- cookie requires Secure, path /, and no Domain attribute. Set those attributes together so browsers accept the intended cookie.

Example

<?php
setcookie("__Host-auth",$token,["secure"=>true,"path"=>"/app"]);

Reported:

• line 2: Set Secure and Path=/ and omit Domain for __Host- cookies.

Detection

• Resolved setcookie/setrawcookie name is literal beginning __Host- and proven options violate Secure=true, Path=/, or omit Domain. Missing path/secure uses their builtin defaults; dynamic options excluded. Options-array keys are matched without regard to ASCII case, as the builtin does (Secure, PATH).
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding. An options array spelling the same attribute more than once with different letter case ("path" and "Path") leaves that attribute unproven.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Configure

In custos.json:

{
  "rules": {
    "HostCookiePrefixContractViolation": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore HostCookiePrefixContractViolation