Cookie Security

What SecurityStatus Checks

• Whether session and authentication cookies have the Secure flag (HTTPS only)
• Whether sensitive cookies have the HttpOnly flag (prevents JavaScript access)
• Whether cookies have the SameSite attribute set (Strict, Lax, or None)
• Whether cookies with SameSite=None also have the Secure flag (required by browsers)

Why This Matters

A cookie without HttpOnly can be stolen by JavaScript injected via an XSS vulnerability. A cookie without Secure can be transmitted over HTTP, allowing interception. SameSite=None without Secure is rejected by modern browsers. These flag misconfigurations are frequently exploited in session hijacking attacks.

How to Fix It

1. 1

   Set the Secure flag on all sensitive cookies

   In your application code, add the Secure attribute when setting cookies. In PHP: `setcookie('session', $value, ['secure' => true, 'httponly' => true, 'samesite' => 'Lax'])`. In Express.js: `{ secure: true, httpOnly: true, sameSite: 'lax' }`.

2. 2

   Set HttpOnly on all session cookies

   Never set HttpOnly=false on authentication or session cookies. There is almost no legitimate reason for JavaScript to read session cookie values.

3. 3

   Set SameSite appropriately

   Use SameSite=Strict for maximum CSRF protection (breaks cross-site navigation). Use SameSite=Lax for a good balance — blocks CSRF from POST requests while allowing GET navigation. Use SameSite=None only for cross-site use cases like embedded widgets (requires Secure).

4. 4

   Scope cookies correctly

   Set the Domain and Path attributes to the narrowest scope needed. Avoid setting Domain=.yourdomain.com unless you specifically need cookie sharing across all subdomains.

Frequently Asked Questions

Related Guides