×
Ranked #1 for value density
First premium report free
LLM-optimized PDFs
How to Secure Cookies
Protect user sessions with these essential flags.
Cookies are a common attack vector for session hijacking, XSS, and CSRF. This guide explains how to properly secure cookies using the Secure, HttpOnly, and SameSite flags, as well as cookie prefixes and encryption.
150+
Security checks
16
Categories covered
30s
Scan duration
100%
Detection coverage
Key Findings
Missing HttpOnly Flag high
Missing SameSite Flag medium
Cookie Without Prefix low
Understanding the Three Essential Cookie Flags
The `Secure` flag ensures cookies are only sent over HTTPS, preventing theft over insecure networks. The `HttpOnly` flag prevents client‑side scripts (JavaScript) from accessing the cookie, mitigating XSS attacks. The `SameSite` flag prevents cross‑site request forgery (CSRF) by controlling when cookies are sent. Use `SameSite=Strict` for session cookies, `Lax` for less critical ones.
How to Set Cookie Flags – Code Examples
Here’s how to set these flags in common languages and frameworks:
- PHP: `setcookie("session", "value", ["secure"=>true, "httponly"=>true, "samesite"=>"Strict"]);`
- Node.js (Express): `res.cookie("session", "value", { secure: true, httpOnly: true, sameSite: "strict" });`
- Python (Django): `SESSION_COOKIE_SECURE = True; SESSION_COOKIE_HTTPONLY = True; SESSION_COOKIE_SAMESITE = "Strict";`
- Python (Flask): `app.config.update(SESSION_COOKIE_SECURE=True, SESSION_COOKIE_HTTPONLY=True, SESSION_COOKIE_SAMESITE="Strict");`
- Java (Spring): `@EnableWebSecurity public class SecurityConfig { ... cookie.setSecure(true); cookie.setHttpOnly(true); cookie.setSameSite("Strict"); }`
- .NET: `HttpCookie cookie = new HttpCookie("session"); cookie.Secure = true; cookie.HttpOnly = true; cookie.SameSite = SameSiteMode.Strict;`
Cookie Prefixes for Extra Security
The `__Secure-` prefix ensures a cookie is only sent over HTTPS and has the Secure flag. The `__Host-` prefix is even stricter – it ensures the cookie is only sent over HTTPS, has the Secure flag, does not have a domain attribute, and has a path of `/`. These prefixes help prevent attackers from injecting cookies via cross‑domain attacks.
Additional Best Practices
Set a reasonable `Max-Age` or `Expires` for session cookies. Avoid storing sensitive data in cookies – if you must, encrypt the value. Use session‑based storage for authentication tokens (JWT can be stored in cookies, but ensure they are short‑lived). Regularly rotate session keys.
The Problem
Insecure cookies expose user sessions
- Cookies sent over HTTP (no Secure flag)
- Cookies accessible to JavaScript (no HttpOnly)
- No CSRF protection (missing SameSite)
- Cookie values exposed in plaintext (no encryption)
OffURL Solution
OffURL detects insecure cookie configurations and provides fix steps
- Scan `Set-Cookie` headers for missing flags
- Validate Secure, HttpOnly, and SameSite settings
- Check for cookie prefixes
- Provide code examples to fix insecure cookies
- Generate an LLM‑ready PDF for AI‑assisted fixes
Key Features
Cookie flag check
We check for Secure, HttpOnly, and SameSite flags on all cookies.
Fix examples
Get ready‑to‑use code for your framework.
LLM‑ready PDF
Get a report formatted for ingestion into your AI assistant.
Actionable fixes
Receive specific recommendations for your stack.
How do I check if my cookies are secure?
Run an OffURL audit. Our scanner extracts all `Set-Cookie` headers and checks for the presence of Secure, HttpOnly, and SameSite flags. You'll get a clear report showing which cookies are insecure and how to fix them. This is one of the easiest security improvements you can make.
Frequently Asked Questions
What is OffURL and how does it work?
OffURL is a comprehensive website security and performance audit tool. It scans your site for 150+ checks including SSL, security headers, malware, XSS, SQL injection, email security, and more.
Is the security audit really free?
Yes. Your first security report is completely free and includes premium features like detailed findings, fix steps, and the full 150+ checks.
How can I use AI to fix security issues?
Download the premium PDF report and paste it into your preferred LLM (Claude, ChatGPT, Gemini, Cursor) with a prompt asking for specific fixes for your framework.
How long does the security audit take?
Most audits complete in 10‑30 seconds. The scan includes DNS lookups, SSL analysis, HTTP requests, port scanning, and vulnerability tests.
Do I need to create an account?
No. OffURL works without registration. Your first audit is free with premium features included.
What vulnerabilities can OffURL detect?
OffURL detects XSS, SQL Injection, NoSQL Injection, LDAP Injection, XXE, SSRF, SSTI, Code Injection, Command Injection, Open Redirect, Path Traversal, LFI, RFI, CRLF Injection, Parameter Pollution, and CORS Misconfiguration.