Cookies are commonly used for sessions, authentication, preferences and cross-site request protection. Sensitive cookies should use attributes that limit how browsers store and send them.
The Secure attribute
The Secure attribute tells the browser to send the cookie only through HTTPS connections. Session and authentication cookies should normally use Secure on public websites.
The HttpOnly attribute
HttpOnly prevents normal browser JavaScript from reading the cookie. It does not prevent every client-side attack, but it can reduce direct cookie theft through injected scripts.
The SameSite attribute
SameSite controls when a cookie is included with cross-site requests.
- Strict: strongest cross-site restriction
- Lax: suitable default for many applications
- None: allows cross-site use and must be paired with Secure
When no cookies are observed
A scanner can evaluate only cookies created by the assessed public response. If the page does not send a Set-Cookie header, the report should state that cookie attributes could not be evaluated rather than reporting a vulnerability.
Common mistakes
- Session cookies without Secure
- Authentication cookies without HttpOnly
- SameSite=None without Secure
- Very broad cookie domains
- Long-lived sensitive cookies without a business need
Recommended review
Inspect cookies created during login, checkout, account recovery and other sensitive workflows, not only the public homepage.