> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit

<AccordionGroup>
  <Accordion title="session-cookie-missing-secure">
    A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
    <br />**OWASP**: <br />- A05:2021 - Security Misconfiguration
  </Accordion>

  <Accordion title="session-cookie-missing-httponly">
    A session cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie which mitigates XSS attacks. Set the 'HttpOnly' flag by setting 'HttpOnly' to 'true' in the Options struct.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
    <br />**OWASP**: <br />- A05:2021 - Security Misconfiguration
  </Accordion>

  <Accordion title="websocket-missing-origin-check">
    The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per "gorilla/websocket" documentation: "A CheckOrigin function should carefully validate the request origin to prevent cross-site request forgery."<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-352: Cross-Site Request Forgery (CSRF)
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="handler-assignment-from-multiple-sources">
    Variable $VAR is assigned from two different sources: '$Y' and '\$R'. Make sure this is intended, as this could cause logic bugs if they are treated as they are the same object.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-289: Authentication Bypass by Alternate Name
  </Accordion>
</AccordionGroup>