← All articles
Web Security 2026-02-15 · 5 min read

Cookie Security: Secure, HttpOnly and SameSite Explained

Cookies often carry session tokens — the keys to a logged-in account. Three flags decide how safely those keys are handled, and missing them is one of the most common findings in a web scan.

The three flags

  • Secure — the cookie is only ever sent over HTTPS, so it cannot leak over an unencrypted connection.
  • HttpOnly — JavaScript cannot read the cookie, which blocks token theft via cross-site scripting (XSS).
  • SameSite — controls whether the cookie is sent on cross-site requests. Lax or Strict defends against cross-site request forgery (CSRF).

Recommended setup

For session cookies, set all three: Set-Cookie: session=...; Secure; HttpOnly; SameSite=Lax; Path=/. Use SameSite=Strict for the most sensitive cookies, and never expose a session token to JavaScript. Run the web scan to see which of your cookies are missing these flags.

Put this into practice
Run a free, private scan — no login, nothing stored.
🛡 Web Scan 🔒 SSL/TLS 📬 MX & Email 🎣 URL Check

Related articles

Web Security What Is a Web Application Firewall (WAF) and Do You Need One? A WAF filters malicious traffic before it reaches your app. Learn what it catches, what it does not, and when it is worth it. Web Security Open Ports: What They Reveal and Which Ones to Close Every open port is a potential door. Here is how to think about port exposure and reduce your attack surface. Web Security CVEs and Outdated Software: Why Version Numbers Matter A known vulnerability in an unpatched server is the easiest way in for attackers. Here is how CVEs work and how to stay ahead.