How to Fix Insecure Cookie Flags (Secure, HttpOnly, SameSite)

Three attributes on a Set-Cookie header, each closing off a completely different attack. Missing any one of them doesn't just weaken a cookie's security - it leaves a specific, well-understood exploit path wide open.

For what each attribute means and when SameSite=None is legitimate, read secure cookie configuration explained. This guide is the quick fix.

What Each Flag Actually Stops

• Secure - the browser will never send this cookie over plain HTTP, only HTTPS. Without it, a session cookie can be sniffed by anyone on the same network as an active man-in-the-middle, or leaked the moment a user follows an old http:// link.
• HttpOnly - JavaScript (document.cookie) can't read this cookie at all. Without it, a single successful XSS injection anywhere on your site can exfiltrate the session cookie directly, turning a script-injection bug into full account takeover.
• SameSite - controls whether the cookie is sent on cross-site requests. Without it (or set to None without Secure), the cookie rides along on requests initiated from other sites, which is the mechanism CSRF attacks depend on.

How to Fix It

Set all three explicitly on session/auth cookies

Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax; Path=/

Node/Express example

app.use(session({
  secret: process.env.SESSION_SECRET,
  cookie: {
    secure: true,     // HTTPS only
    httpOnly: true,    // no JS access
    sameSite: "lax",   // blocks most cross-site CSRF vectors
  },
}));

Pick SameSite based on what the cookie actually needs to survive

• Strict - the tightest option; the cookie is never sent on any cross-site request, including a user clicking a link into your site from elsewhere.
• Lax - the sane default for most session cookies; blocks cross-site POSTs (the main CSRF vector) while still allowing the cookie on top-level navigation.
• None - required for cookies that genuinely need to work across sites (an embedded widget, for example) - but None without Secure is rejected by modern browsers outright.

How Scanverra Detects This

Scanverra's security scan inspects every Set-Cookie header your site sends and flags each cookie missing Secure, HttpOnly, or SameSite individually, so you get a specific list of which cookies need which flag rather than a single generic warning.