Fix: cookie without Secure, HttpOnly or SameSite flags

The finding means a cookie that carries a session or token is missing at least one protective attribute. Secure stops the cookie being sent over plain http. HttpOnly hides it from JavaScript, so a cross-site scripting bug cannot read it. SameSite limits when it is sent on requests coming from other sites, which reduces cross-site request forgery. Cookies for harmless preferences, such as a theme, do not need HttpOnly.

• The cookie is set from browser code with document.cookie, which cannot set HttpOnly.
• Generated server code calls a set-cookie helper with only a name and value, so every attribute falls back to the default.
• Secure was switched off so login would work on http://localhost and the change was shipped.
• SameSite=None was copied from a snippet. It is needed only for genuine cross-site use and must be paired with Secure.
• A proxy terminates HTTPS and the framework, unaware the connection is secure, drops the Secure flag. In Express this is fixed with the trust proxy setting.

1. 1Open devtools, Application, Cookies and find which cookies lack the flags. Note which ones hold sessions or tokens.
2. 2Find where each is set: your code, an auth library's config, or a third-party service.
3. 3Set the cookie on the server with httpOnly, secure and sameSite. Keep secure on in production. Browsers treat localhost as secure, so you rarely need to turn it off for development.
4. 4Pick SameSite=Lax for most apps. Use Strict if no flow depends on arriving from another site already logged in.
5. 5Consider the __Host- name prefix, which makes browsers require Secure, Path=/ and no Domain attribute.
6. 6If the token currently lives in localStorage or a readable cookie, move it to an HttpOnly cookie set by your server.

import { cookies } from 'next/headers';

export async function POST() {
  const cookieStore = await cookies();
  cookieStore.set('__Host-session', sessionId, {
    httpOnly: true,
    secure: true,
    sameSite: 'lax',
    path: '/',
    maxAge: 60 * 60 * 24 * 7,
  });
  return Response.json({ ok: true });
}

app.set('trust proxy', 1);
res.cookie('__Host-session', sessionId, {
  httpOnly: true,
  secure: true,
  sameSite: 'lax',
  path: '/',
  maxAge: 1000 * 60 * 60 * 24 * 7,
});

• Log in to your own app, then check devtools, Application, Cookies. The session cookie should show ticks under HttpOnly and Secure, and Lax or Strict under SameSite.
• In the console, run document.cookie. The session cookie must not appear in the output.
• Inspect the raw header from your login endpoint with the curl command below, using a test account.

curl -s -D - -o /dev/null https://www.yourapp.com/api/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"test@yourapp.com","password":"YOUR_TEST_PASSWORD"}' | grep -i set-cookie