Cookie Security Attributes: Secure, HttpOnly & SameSite Flags

Overview of Cookie Security Attributes#

HTTP cookies are the primary mechanism used by web applications to maintain session state, authenticate users, and store user preferences. Because authentication cookies represent the user's active session, capturing or tampering with them allows attackers to hijack accounts without knowing the user's password.

SiteSecura's scanner inspects all Set-Cookie response headers returned by your web application and verifies whether three essential defensive attributes are present: Secure, HttpOnly, and SameSite.

---

The Three Core Cookie Security Flags#

1. The Secure Attribute#

• Risk Without It: Cleartext transmission over unencrypted HTTP connections. If a user connects to a public Wi-Fi network and types http://yourdomain.com, the browser transmits the cookie in plaintext before any HTTPS redirect occurs.
• Defense: Tells the browser that the cookie must only be transmitted over encrypted HTTPS connections.
• Evaluation: Any session cookie missing the Secure flag triggers a Medium Severity (-5 pts) deduction.

2. The HttpOnly Attribute#

• Risk Without It: Client-side JavaScript theft via Cross-Site Scripting (XSS). If an attacker finds a script injection flaw on your website, they can execute document.cookie and exfiltrate the session token to a remote server.
• Defense: Blocks client-side scripts from reading or writing to the cookie via the DOM. The cookie remains available for HTTP requests but is inaccessible to JavaScript.
• Evaluation: Any session cookie missing HttpOnly triggers a Medium Severity (-5 pts) deduction.

3. The SameSite Attribute#

• Risk Without It: Cross-Site Request Forgery (CSRF). Malicious websites can force the victim's browser to submit authenticated requests (such as transferring funds or changing an email address) to your domain.
• Defense: Controls whether cookies are sent along with cross-site requests.
• Supported Values:
  • SameSite=Strict: Highest protection. The cookie is never sent with cross-site requests (even when clicking a regular external link).
  • SameSite=Lax: Recommended default. The cookie is withheld on cross-site subrequests (images, iframes), but sent when the user navigates top-level links.
  • SameSite=None: Requires the Secure flag. Allows third-party cross-origin transmission.

---

Implementation Examples#

Standard HTTP Set-Cookie Header:#

HTTP
Copy
Set-Cookie: session_id=abc123xyz789; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=86400

Node.js / Express Example:#

JAVASCRIPT
Copy
app.use(session({
  secret: process.env.SESSION_SECRET,
  cookie: {
    secure: true,      // Requires HTTPS
    httpOnly: true,    // Inaccessible to JS document.cookie
    sameSite: 'lax',   // CSRF defense
    maxAge: 24 * 60 * 60 * 1000 // 24 hours
  }
}));

Python / FastAPI Example:#

PYTHON
Copy
from fastapi import Response

@app.post("/login")
def login(response: Response):
    response.set_cookie(
        key="session_token",
        value="secure_token_abc123",
        httponly=True,
        secure=True,
        samesite="lax",
        max_age=86400
    )
    return {"status": "authenticated"}

Nginx Proxy Cookie Flags:#

If your backend application is proxied behind Nginx, you can instruct Nginx to automatically enforce these flags on all upstream Set-Cookie headers:

NGINX
Copy
# Automatically append Secure, HttpOnly, and SameSite
proxy_cookie_flags ~* secure httponly samesite=lax;