include::../description.adoc[]

include::../ask-yourself.adoc[]

include::../recommended.adoc[]

== Sensitive Code Example

For https://pkg.go.dev/std[Go Standard Library]:

[source,go,diff-id=1,diff-type=noncompliant]
----
import "net/http"

func handler(w http.ResponseWriter, req *http.Request) {
    cookie := http.Cookie{}
    cookie.Name = "cookiename"
    cookie.Value = "cookievalue"
    http.SetCookie(w, &cookie) // Sensitive: HttpOnly is false by default
}
----

For https://pkg.go.dev/github.com/beego/beego/v2/server/web[Beego]:

[source,go,diff-id=2,diff-type=noncompliant]
----
import "github.com/beego/beego/v2/server/web"

func (ctrl *MainController) handler() {
    ctrl.Ctx.SetCookie("name1", "value1", 200, "/", "example.com", false, false) // Sensitive
}
----

For https://pkg.go.dev/github.com/gofiber/fiber/v2[Fiber]:

[source,go,diff-id=3,diff-type=noncompliant]
----
import "github.com/gofiber/fiber/v2"

func handler(c *fiber.Ctx) error {
    cookie := new(fiber.Cookie)
    cookie.Name = "name"
    cookie.Value = "value"
    c.Cookie(cookie) // Sensitive: HttpOnly is false by default
    return c.SendString("")
}
----

For https://pkg.go.dev/github.com/gin-gonic/gin[Gin]:

[source,go,diff-id=4,diff-type=noncompliant]
----
import "github.com/gin-gonic/gin"

func handler(c *gin.Context) {
    c.SetCookie("name", "value", 200, "/", "example.com", false, false) // Sensitive
    c.JSON(http.StatusOK, gin.H{"message": ""})
}
----

== Compliant Solution

For https://pkg.go.dev/std[Go Standard Library]:

[source,go,diff-id=1,diff-type=compliant]
----
import "net/http"

func handler(w http.ResponseWriter, req *http.Request) {
    cookie := http.Cookie{}
    cookie.Name = "cookiename"
    cookie.Value = "cookievalue"
    cookie.HttpOnly = true
    http.SetCookie(w, &cookie)
}
----

For https://pkg.go.dev/github.com/beego/beego/v2/server/web[Beego]:

[source,go,diff-id=2,diff-type=compliant]
----
import "github.com/beego/beego/v2/server/web"

func (ctrl *MainController) handler() {
    ctrl.Ctx.SetCookie("name1", "value1", 200, "/", "example.com", false, true)
}
----

For https://pkg.go.dev/github.com/gofiber/fiber/v2[Fiber]:

[source,go,diff-id=3,diff-type=compliant]
----
import "github.com/gofiber/fiber/v2"

func handler(c *fiber.Ctx) error {
    cookie := new(fiber.Cookie)
    cookie.Name = "name"
    cookie.Value = "value"
    cookie.HTTPOnly = true
    c.Cookie(cookie)
    return c.SendString("")
}
----

For https://pkg.go.dev/github.com/gin-gonic/gin[Gin]:

[source,go,diff-id=4,diff-type=compliant]
----
import "github.com/gin-gonic/gin"

func handler(c *gin.Context) {
    c.SetCookie("name", "value", 200, "/", "example.com", false, true)
    c.JSON(http.StatusOK, gin.H{"message": ""})
}
----

include::../see.adoc[]

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::../message.adoc[]

=== Highlighting

For Go Standard Library:

* Highlight `SetCookie` if it is assigned an `http.Cookie` that has not `HttpOnly` field specified.
* Highlight `HttpOnly` field of `http.Cookie` if it is set to `false`.

For Beego:

* Highlight the 7th argument of `web.Controller.Context.SetCookie` if it is set to `false`.
* Highlight the 7th argument of `web.Controller.Context.Output.Cookie` if it is set to `false`.
* Highlight the 7th argument of `web.Controller.Context.SetSecureCookie` if it is set to `false`.

For Fiber:

* Highlight `Cookie` if it is assigned a `fiber.Cookie` that has not `HTTPOnly` field specified.
* Highlight `HTTPOnly` field of `fiber.Cookie` if it is set to `false`.

For Gin:

* Highlight the 7th argument of `gin.Context.SetCookie` if it is set to `false`.

'''
== Comments And Links
(visible only on this page)

include::../comments-and-links.adoc[]

endif::env-github,rspecator-view[]
