Session cookie without protective flags
Checks that cookies that look like sessions are Secure, HttpOnly and have SameSite.
Recommended next step if found
Set session cookies with Secure, HttpOnly and SameSite=Lax (or Strict).
Cookie security
Secure, HttpOnly and SameSite attributes affect browser handling of cookies. The relevant requirements depend on the cookie’s purpose and the application.
Related public checks
The following checks provide related public observations. Their presence does not mean this entire topic has been tested or that the application is secure.
Cookies without Secure flag
Checks that cookies set over HTTPS carry the Secure flag.
Recommended next step if found
Add the Secure flag to every cookie the site sets over HTTPS.
Keep the scope.
A blocked or unfinished check remains unverified. Review technical recommendations with the person operating the website and test changes before applying them to a live service.
Read the full methodology