Cookie Security Flags (Cookie Security)
Why Cookie Security Is Important
Cookies are the primary mechanism for maintaining authenticated sessions on the web. If session cookies lack proper security flags, they are vulnerable to theft and misuse. An XSS attack can steal cookies that lack HttpOnly. A MITM attack can intercept cookies that lack Secure. A CSRF attack can abuse cookies that lack SameSite.
The Secure flag prevents cookies from being sent over plain HTTP connections, which would expose them to network eavesdroppers. The HttpOnly flag prevents JavaScript from reading the cookie, mitigating XSS-based session theft. The SameSite flag prevents the browser from sending the cookie with cross-origin requests, mitigating CSRF.
All three flags should be set on session cookies and any cookies containing sensitive data. Modern web frameworks typically set these flags by default, but you should verify. Missing security flags on session cookies is one of the most common security findings in web application assessments.
Testing Your Configuration
A security audit checks the security flags on cookies set by your site. Verify that session cookies have Secure, HttpOnly, and SameSite=Lax (or Strict) flags. Check that cookie scope (Domain and Path) is as restrictive as possible.