What makes cookies secure

How it works

A cookie is a small value that the server stores in the browser with the Set-Cookie header and that the browser sends back with every further request. The most important one is the session cookie: whoever has it is logged in to your website. That makes cookies worth stealing, or abusing, for attackers.

Three attributes after the value protect against this:

• Secure: the browser sends the cookie over HTTPS only, never over an unencrypted connection where someone could read it.
• HttpOnly: scripts on the page cannot read the cookie. An injected script cannot get at the session.
• SameSite: it decides whether the cookie goes along when another site triggers a request to yours. Strict never sends it then, Lax only when the visitor follows a link to your site, None always.

What matters

• Always Secure. Without Secure a cookie can be read on any unencrypted connection. On a site that runs on HTTPS only, there is no reason to leave it out.
• Set SameSite explicitly. Lax suits most cookies, Strict the especially sensitive ones. Without it, Chrome treats cookies as Lax, other browsers not consistently. SameSite=None only works together with Secure and is only meant for cookies needed in embedded content on other sites.
• HttpOnly when no script needs the cookie. For session cookies it is a must. Some cookies are read by a script on purpose, such as a language setting; then leaving it out is not a mistake.
• What the report sees. It checks the cookies your start page sets through headers. Cookies created later by a script in the browser, and cookies after login, do not show up there; check them in the browser's developer tools.

How to set it up

A session cookie looks like this:

Set-Cookie: session=…; Path=/; Secure; HttpOnly; SameSite=Lax

The attributes are set by the application that creates the cookie: the CMS, the shop or the framework. For sessions there is usually a setting, in PHP for example session.cookie_secure, session.cookie_httponly and session.cookie_samesite. Cookies from plugins or third parties can often only be changed through their own settings. You do this in the admin area, or your agency does it in the configuration.