Require "secure" cookies

[kkmuffme]

Is your feature request related to a problem?

setcookie should have the $secure parameter be set to true in all cases for improved security.
There is no downside to it.

Optionally a separate rule that requires httponly true (can be easily disabled for phpcs:ignore if one needs them in js), again for improved security.

Describe the solution you'd like

If a/any setcookie function does not have true as the last parameter (if checking for httponly too - the last 2 parameters), throw an error.

setcookie($cookie_name);
setcookie($cookie_name, $cookie_value );
setcookie($cookie_name, $cookie_value, time() + (86400 * 30) );
setcookie($cookie_name, $cookie_value, time() + (86400 * 30), "/", '' );
setcookie($cookie_name, $cookie_value, time() + (86400 * 30), "/", 'test.com' );
setcookie($cookie_name, $cookie_value, time() + (86400 * 30), "/", '', true ); // this is correct
setcookie($cookie_name, $cookie_value, time() + (86400 * 30), "/", 'test.com', true ); // this is correct
setcookie($cookie_name, $cookie_value, time() + (86400 * 30), "/", '', false, true); // Attention here!
setcookie($cookie_name, $cookie_value, time() + (86400 * 30), "/", '', true, true ); // this is correct

So it could work for:
setcookie
wc_setcookie
custom_setcookie

Additional context (optional)

This is relatively simple to check, EXCEPT that some plugins provide the flag to be filterable, which would be impossible to detect.
e.g.

wc_setcookie( $this->_cookie, $cookie_value, $this->_session_expiration, apply_filters( 'wc_session_use_secure_cookie', false ) );

However, there really is no reason in 2019, where you get SSL certs for free with letsencrypt, to not use secure cookies, thus I think we can ignore these filterable ones and flag them as wrong.

[johnbillion]

How does this affect a site that doesn't use HTTPS?

[kkmuffme]

The Secure attribute limits the scope of the cookie to "secure" channels (where "secure" is defined by the user agent). When a cookie has the Secure attribute, the user agent will include the cookie in an HTTP request only if the request is transmitted over a secure channel (typically HTTP over Transport Layer Security (TLS) [RFC2818]).

This means that the cookie will only be sent to the server, if the connection is via HTTPS
(this however does NOT mean that you can only set cookies via https)

However, you really should be using SSL in 2019, as it's available for free in hosted solutions (e.g. via Cloudflare) as via standalone (via lets encrypt, which even allows you to create localhost SSL certs for dev purposes).

[johnbillion]

This sounds like something out of scope for WPCS.

[kkmuffme]

Could you elaborate why you think it's out of scope for WPCS?

A big part of WPCS is dedicated to ensure WP (plugin/theme) code is more secure. This falls exactly into it.

[johnbillion]

Right, but this has side effects. Encouraging users to use HTTPS is one thing, introducing a code sniffing rule which breaks HTTP sites is another.

There are other more appropriate avenues to encourage users to implement HTTPS.

[kkmuffme]

Yes, but it's not about getting it auto-fixed. It's about displaying a warning, perhaps just with severity 1.
This will not break anything by default.

This is alike to how the escaping functions work - you get a warning & if you just add them blindly like wpcs suggests, you can be sure to break functionality since lots of times you have to customise the escape filters (even of wp_kses_post, e.g. to make it work with picture tag, ...).