HTTPS & cookies

How to fix: Cookie security flags (Secure, HttpOnly, SameSite)

Three cookie attributes limit how a cookie can be used: Secure (HTTPS only), HttpOnly (hidden from JavaScript) and SameSite (limits cross-site sending).

Not sure whether your site has this problem? Check it in seconds.

Run a free audit

Why it matters

Session and login cookies are what attackers want. HttpOnly keeps them away from injected scripts, Secure keeps them off unencrypted connections, and SameSite reduces cross-site request forgery. Not every cookie needs all three, for example a theme preference doesn't need HttpOnly.

How to check

DevTools → Application → Cookies shows each cookie's flags. Note that our scanner can only see cookies your server sets on the page it fetched.

How to fix it

Raw header

Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=Lax

Express

res.cookie('session', token, { httpOnly: true, secure: true, sameSite: 'lax' });

Next.js (route handler)

import { cookies } from 'next/headers';
(await cookies()).set('session', token, { httpOnly: true, secure: true, sameSite: 'lax', path: '/' });

PHP

setcookie('session', $token, ['secure' => true, 'httponly' => true, 'samesite' => 'Lax', 'path' => '/']);

Common mistakes

SameSite=None without Secure: browsers reject it.
Setting Secure while developing on plain http://localhost, then wondering why the cookie vanishes. Many browsers allow it on localhost; otherwise toggle by environment.

Frequently asked questions

Which cookies must be HttpOnly?

Anything that authenticates a user (session IDs, tokens) and doesn't need to be read by your own front-end JavaScript.

Related guides

Guidance is general. Test header and DNS changes on a staging copy first, and check your hosting provider's documentation for platform-specific steps.