CA5382: Use secure cookies in ASP.NET Core
Property | Value |
---|---|
Rule ID | CA5382 |
Title | Use secure cookies in ASP.NET Core |
Category | Security |
Fix is breaking or non-breaking | Non-breaking |
Enabled by default in .NET 9 | No |
The Microsoft.AspNetCore.Http.CookieOptions.Secure property is set as false
when invoking Microsoft.AspNetCore.Http.IResponseCookies.Append. For now, this rule only looks at the Microsoft.AspNetCore.Http.Internal.ResponseCookies class, which is one of the implementations of IResponseCookies.
This rule is similar to CA5383, but analysis can determine that the Secure property is definitely false
or not set.
By default, this rule analyzes the entire codebase, but this is configurable.
Applications available over HTTPS must use secure cookies, which indicate to the browser that the cookie should only be transmitted using Transport Layer Security (TLS).
Set Secure property as true
.
If cookies are configured to be secure by default, such as using Microsoft.AspNetCore.CookiePolicy.CookiePolicyMiddleware in
Startup.Configure
:public class Startup { public void Configure(IApplicationBuilder app, IWebHostEnvironment env) { app.UseCookiePolicy( new CookiePolicyOptions { Secure = CookieSecurePolicy.Always }); } }
If you're sure there's no sensitive data in the cookies.
If you just want to suppress a single violation, add preprocessor directives to your source file to disable and then re-enable the rule.
#pragma warning disable CA5382
// The code that's violating the rule is on this line.
#pragma warning restore CA5382
To disable the rule for a file, folder, or project, set its severity to none
in the configuration file.
[*.{cs,vb}]
dotnet_diagnostic.CA5382.severity = none
For more information, see How to suppress code analysis warnings.
Use the following options to configure which parts of your codebase to run this rule on.
You can configure these options for just this rule, for all rules it applies to, or for all rules in this category (Security) that it applies to. For more information, see Code quality rule configuration options.
You can exclude specific symbols, such as types and methods, from analysis. For example, to specify that the rule should not run on any code within types named MyType
, add the following key-value pair to an .editorconfig file in your project:
dotnet_code_quality.CAXXXX.excluded_symbol_names = MyType
Allowed symbol name formats in the option value (separated by |
):
- Symbol name only (includes all symbols with the name, regardless of the containing type or namespace).
- Fully qualified names in the symbol's documentation ID format. Each symbol name requires a symbol-kind prefix, such as
M:
for methods,T:
for types, andN:
for namespaces. .ctor
for constructors and.cctor
for static constructors.
Examples:
Option Value | Summary |
---|---|
dotnet_code_quality.CAXXXX.excluded_symbol_names = MyType |
Matches all symbols named MyType . |
dotnet_code_quality.CAXXXX.excluded_symbol_names = MyType1|MyType2 |
Matches all symbols named either MyType1 or MyType2 . |
dotnet_code_quality.CAXXXX.excluded_symbol_names = M:NS.MyType.MyMethod(ParamType) |
Matches specific method MyMethod with the specified fully qualified signature. |
dotnet_code_quality.CAXXXX.excluded_symbol_names = M:NS1.MyType1.MyMethod1(ParamType)|M:NS2.MyType2.MyMethod2(ParamType) |
Matches specific methods MyMethod1 and MyMethod2 with the respective fully qualified signatures. |
You can exclude specific types and their derived types from analysis. For example, to specify that the rule should not run on any methods within types named MyType
and their derived types, add the following key-value pair to an .editorconfig file in your project:
dotnet_code_quality.CAXXXX.excluded_type_names_with_derived_types = MyType
Allowed symbol name formats in the option value (separated by |
):
- Type name only (includes all types with the name, regardless of the containing type or namespace).
- Fully qualified names in the symbol's documentation ID format, with an optional
T:
prefix.
Examples:
Option Value | Summary |
---|---|
dotnet_code_quality.CAXXXX.excluded_type_names_with_derived_types = MyType |
Matches all types named MyType and all of their derived types. |
dotnet_code_quality.CAXXXX.excluded_type_names_with_derived_types = MyType1|MyType2 |
Matches all types named either MyType1 or MyType2 and all of their derived types. |
dotnet_code_quality.CAXXXX.excluded_type_names_with_derived_types = M:NS.MyType |
Matches specific type MyType with given fully qualified name and all of its derived types. |
dotnet_code_quality.CAXXXX.excluded_type_names_with_derived_types = M:NS1.MyType1|M:NS2.MyType2 |
Matches specific types MyType1 and MyType2 with the respective fully qualified names, and all of their derived types. |
The following snippet illustrates the pattern detected by this rule.
Violation:
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Http.Internal;
class ExampleClass
{
public void ExampleMethod(string key, string value)
{
var cookieOptions = new CookieOptions();
cookieOptions.Secure = false;
var responseCookies = new ResponseCookies(null, null);
responseCookies.Append(key, value, cookieOptions);
}
}
Solution:
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Http.Internal;
class ExampleClass
{
public void ExampleMethod(string key, string value)
{
var cookieOptions = new CookieOptions();
cookieOptions.Secure = true;
var responseCookies = new ResponseCookies(null, null);
responseCookies.Append(key, value, cookieOptions);
}
}
.NET feedback
.NET is an open source project. Select a link to provide feedback: