New Rule: Cookie Security

[ejohn20]

Puma Scan didn’t detect missing HttpOnly and Secure flags here.

Secure settings are Secure = true, HttpOnly = true, and Expires can only be set to a past date.

HttpCookie CreateCookie(string value)
{
      var ck = new HttpCookie(COOKIE_NAME, value);
      if (string.IsNullOrWhiteSpace(value)) ck.Expires = DateTime.Now.AddYears(-1);
      return ck;
}

or

```cs
Response.SetCookie(new HttpCookie("sid", sid) { Expires = DateTime.Now.AddDays(1) });

[ejohn20]

Here's another sink in .NET Core

CookieOptions options = new CookieOptions() {
   HttpOnly = true,
   Secure = true,
   SameSite = SameSiteMode.Strict,
};