Use Safe Parameters in flask Response set_cookie Call

[pixeebot]

This codemod sets the most secure parameters when Flask applications call set_cookie on a response object. Without these parameters, your Flask
application cookies may be vulnerable to being intercepted and used to gain access to sensitive data.

The changes from this codemod look like this:

  from flask import Flask, session, make_response
  app = Flask(__name__)
  @app.route('/')
    def index():
      resp = make_response('Custom Cookie Set')
    - resp.set_cookie('custom_cookie', 'value')
    + resp.set_cookie('custom_cookie', 'value', secure=True, httponly=True, samesite='Lax')
      return resp

More reading

• https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie
• https://owasp.org/www-community/controls/SecureCookieAttribute
• https://cwe.mitre.org/data/definitions/614

I have additional improvements ready for this repo! If you want to see them, leave the comment:

@pixeebot next

... and I will open a new PR right away!

🧚🤖 Powered by Pixeebot

Feedback | Community | Docs | Codemod ID: pixee:python/secure-flask-cookie