VBC-011: document-cookie-direct

warning

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .tsx, .astro
Scope: source code only, ignoring anything inside strings and comments
Tags: security clean-code

What it reports

Direct document.cookie write at line {line}. Manual cookie manipulation is error-prone and easy to misconfigure. Use a cookie library that enforces proper security flags (HttpOnly, Secure, SameSite) by default.

Flagged

document.cookie = "session=abc";

Not flagged

if (document.cookie === "") { init(); }

Pattern

document\.cookie\s*=(?!=)