Exposure
Session cookies can be stolen or misused
Insecure cookie attributes
What this means
Your app sets cookies without the flags that keep them safe: they can be read by scripts, sent over an insecure connection, or attached to requests coming from other sites.
Why it matters
A session cookie is the key to an account. Without these flags one cross-site script or one insecure request hands that key to someone else — and the user stays signed in, unaware.
How to fix it
- Set HttpOnly, Secure and SameSite on every session cookie.
Prompt for your AI agent
Set HttpOnly, Secure and SameSite=Lax on all session cookies so they cannot be read by scripts or sent from other sites.
Verify the fix: inspect the cookie in your browser and confirm the flags are set
Is your app doing this?
Find out in about a minute — the first scan is free.