SEC-011
Session cookie set without Secure or HttpOnly
MediumDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Set-Cookie headers on the page response, for cookies whose names mark them as session or auth cookies. Analytics and preference cookies are not judged: they are meant to be readable by scripts. A missing SameSite is not reported because browsers default it to Lax.
Why it matters
Session cookies without these flags can be stolen by injected scripts or sent on cross-site requests.
Recommended fix
Set Secure, HttpOnly and SameSite=Lax (or Strict) on session and auth cookies.
How to verify
In DevTools → Application → Cookies, confirm each auth cookie shows Secure, HttpOnly and SameSite.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-011: Session cookie set without Secure or HttpOnly
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Find where the app sets cookies and add the attributes Secure, HttpOnly and SameSite=Lax to every session or auth cookie. Keep cookies that must be read by client JavaScript non-HttpOnly only if truly required.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: In DevTools → Application → Cookies, confirm each auth cookie shows Secure, HttpOnly and SameSite.