rules:
- id: session-cookie-missing-secure
  patterns:
  - pattern-not-inside: |
      &sessions.Options{
        ...,
        Secure: true,
        ...,
      }
  - pattern: |
      &sessions.Options{
        ...,
      }
  message: >-
    A session cookie was detected without setting the 'Secure' flag.
    The 'secure' flag for cookies prevents the client from transmitting
    the cookie over insecure channels such as HTTP.  Set the 'Secure'
    flag by setting 'Secure' to 'true' in the Options struct.
  metadata:
    cwe: "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"
    owasp: 'A3: Sensitive Data Exposure'
    references:
    - https://github.com/0c34/govwa/blob/139693e56406b5684d2a6ae22c0af90717e149b8/user/session/session.go#L69
    category: security
    technology:
    - gorilla
  fix-regex:
    regex: (Secure\s*:\s+)false
    replacement: \1true
  severity: WARNING
  languages: [go]