Fix guide · Web application · low

Cookies missing Secure or HttpOnly

Session cookies without the Secure flag can be sent over plain HTTP and read on the network. Without HttpOnly, any script on the page, including an injected one, can read them and hijack the session.

How to fix it

session.cookie_secure = 1
session.cookie_httponly = 1
session.cookie_samesite = "Lax"

proxy_cookie_flags ~ secure httponly samesite=lax;

app.use(session({
  cookie: { secure: true, httpOnly: true, sameSite: 'lax' }
}));

@ini_set('session.cookie_secure', 1);
@ini_set('session.cookie_httponly', 1);

The scan result lists the exact cookie names that are missing a flag.

Check your fix

Common mistakes

• Setting Secure on a site that still serves some pages over HTTP, so the cookie disappears there.
• Setting HttpOnly on a cookie your own JavaScript needs to read (keep those non-sensitive).