R2.7: Secure cookie & CORS hygiene

Short answer: HttpOnly, Secure, SameSite, no wildcard CORS with credentials. A cookie without these flags can be read by scripts or sent from another site.

Group: Security and tenancy. Status: stable. Generated from the rule definitions; do not edit by hand.

Playground: https://brevio.pro/tools/agent-guard-playground?rule=R2.7

What it catches

Secure cookie & CORS hygiene: HttpOnly, Secure, SameSite, no wildcard CORS with credentials.

Why

A cookie without these flags can be read by scripts or sent from another site.

A bad example

res.cookie('sid', id);

A good example

res.cookie('sid', id, { httpOnly: true, secure: true, sameSite: 'lax' });

How it is checked

• A one-line card in the prompt of a slice that touches matching files (dev_rules.slice_micro_rules).

How to silence it

A person can silence one finding with brevio-core: ignore R2.7 -- reason on the line or the line above. Without the reason it does not count. An agent cannot silence it: the agent hook and the MCP tools never honour the comment, and a pull request that adds one is reported until a reviewer allows it. Fixing the code is still the better answer.

To change what the rule flags, edit its definition in dev_rules.py or code_rules/__init__.py. That is a code change and is reviewed like one.

Related rules

• R2.8 No unsafe code or HTML sinks
• R2.1 Tenant context derivation
• R2.2 Tenant-scoped data access
• R2.3 Dual-key entity resolution
• Every rule