Cookies are Secure, HttpOnly and SameSite

What this means

Passing means every Set-Cookie header on your HTML response carries Secure, HttpOnly and a SameSite value where they apply. Failing means a cookie, usually the session, is missing one of them: it can travel over plain HTTP, be read by any script that runs on the page, or be sent along with a request another site started. A cookie that is not a credential, such as a theme preference, does not need HttpOnly.

How we test it

We fetch your home page once and read every Set-Cookie header on the response. Pass is every cookie carrying Secure, HttpOnly and SameSite. Warn is a cookie missing SameSite only. Fail is a cookie missing Secure or HttpOnly.

Why it matters

A session cookie without HttpOnly is one XSS away from theft. Any script that runs on your page, including a third-party tag or an injected one, can read document.cookie and send the session elsewhere, and the thief then is the user until the session expires. Secure keeps the cookie off plain HTTP, and SameSite stops another site from making your browser send it. Module 5 sidesteps most of this by sending the session as a bearer token in the Authorization header, which the shared gate reads and which cookies and the query string never carry.

The fix

Set Secure, HttpOnly and SameSite on every session cookie at the one place your server or framework issues it, and never read a cookie as a credential in client JavaScript or in an endpoint; Module 3's gate takes the credential from the Authorization header only. If a data route is still gated by an older cookie, switch it to the gate before you delete the old credential, because that is one of the three things that break when a dashboard migrates. The full runbook is in the Fix Kit, Module 05.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Run once: curl -s -D - -o /dev/null https://YOUR_DOMAIN | grep -i '^set-cookie' and show me every line.
For each cookie, tell me which of Secure, HttpOnly and SameSite is present, what the cookie is for, and where in the code or framework config it is set.
Tell me whether any endpoint or page reads a cookie as its credential instead of the Authorization header (grep for req.cookies, document.cookie and cookies().get).
Do not change any cookie, config or endpoint; list what it would take to set the three flags on each cookie and stop.
Run the curl once more and show me the output; expected for a passing project: every Set-Cookie line contains Secure, HttpOnly and SameSite.