Insecure Cookie Flags (HttpOnly / SameSite / Secure)

Cookie attributes are cheap, high-leverage defenses. Their absence amplifies other vulnerabilities.

The flags

• HttpOnly — blocks JavaScript from reading the cookie. Without it, any XSS becomes session theft.
• Secure — sends the cookie only over HTTPS. Without it, a single HTTP request can leak the session on a hostile network.
• SameSite — controls cross-site sending. Lax or Strict mitigates CSRF; None (required for cross-site) must be paired with Secure.
• Domain/Path scope — overly broad Domain shares cookies with subdomains an attacker might control.

How to test

Inspect Set-Cookie headers on the session cookie. Flag any session cookie missing HttpOnly or Secure, or set to SameSite=None without justification, or scoped to a parent domain unnecessarily.

Impact

Enables XSS-to-session-theft, CSRF, and cookie leakage over insecure transport.

Defenses

• Set HttpOnly; Secure; SameSite=Lax (or Strict) on session cookies by default.
• Scope Domain/Path as narrowly as possible; use __Host- prefixed cookies where applicable.