Secure your cookies

Web headers · about 15 min

In plain words

Cookies often hold login sessions. Three flags protect them: Secure (HTTPS only), HttpOnly (scripts can’t read it) and SameSite (not sent on cross-site requests).

What can go wrong

Session cookies can be stolen over plain HTTP, read by injected scripts, or abused in cross-site request forgery.

How to fix it

Pick the platform your site runs on. Not sure? Forward this page to whoever manages your website.

Raw header

Set-Cookie: session=…; Path=/; Secure; HttpOnly; SameSite=Lax

PHP

session_set_cookie_params(['secure' => true, 'httponly' => true, 'samesite' => 'Lax']);

Express (Node)

res.cookie('session', value, { secure: true, httpOnly: true, sameSite: 'lax' });

Nginx (proxy)

proxy_cookie_flags ~ secure httponly samesite=lax;

WordPress

// wp-config.php
@ini_set('session.cookie_secure', 1);
@ini_set('session.cookie_httponly', 1);
@ini_set('session.cookie_samesite', 'Lax');

Before you change anything: Skip HttpOnly only for cookies your own JavaScript must read (e.g. a theme preference). Use SameSite=None; Secure only for cookies that must work inside third-party iframes.

Check that it worked

Re-run the ProbeHunt check, or inspect DevTools → Application → Cookies.

Re-run the free check

References

MDN: Set-Cookie