Skip to main content
SlapMyWeb
Slap a site

Security fix

How to Secure Cookies (Secure, HttpOnly, SameSite)

Add the flags that stop cookies being stolen over HTTP, via XSS, or in CSRF attacks.

Difficulty
Easy
Impact
High
Time
10 min

Before

Set-Cookie: session=abc123

After

Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax; Path=/
Before and after code for: How to Secure Cookies (Secure, HttpOnly, SameSite)

A cookie without the Secure flag can be sent over an unencrypted connection, where it can be read in transit. Set Secure on every cookie so it is only sent over HTTPS, add HttpOnly so JavaScript cannot read session cookies, and set SameSite to Lax or Strict to limit what a cross-site request can do with them.

Why it matters

A session cookie without the right flags can be sent over plain HTTP (Secure fixes this), read by JavaScript in an XSS attack (HttpOnly fixes this), or sent on cross-site requests in CSRF (SameSite fixes this). Auth cookies should always set all three.

How to fix it

  1. Add the flags

    Set Secure, HttpOnly and SameSite on session/auth cookies.

  2. Choose the right SameSite

    Use Lax for most cookies; Strict for the most sensitive; None; Secure only when a cookie must cross sites.

The code

Beforehttp
Set-Cookie: session=abc123
Afterhttp
Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax; Path=/

On your platform

WordPress

WordPress sets sensible auth-cookie flags on HTTPS; review custom cookies set by plugins or theme code.

Next.js

Set secure, httpOnly, sameSite in cookies().set() options.

Sources

Check your site with our free tool

HTTP Header Checker

More fixes

Security

How to Add X-Content-Type-Options: nosniff

Stop browsers from MIME-sniffing responses: a one-line header that closes an XSS vector.

Security

How to Add a Permissions-Policy Header

Restrict which browser features (camera, mic, geolocation) the page and its iframes can use.

Security

How to Fix a Missing SSL Certificate

Serve the whole site over HTTPS so browsers stop marking it as not secure.

Fixed that one.
Now find the rest.

A free audit ranks every issue on your site by the score points it costs, and links each one straight to its guide.

Run a free audit
Free foreverNo signupLive scan progress