Cookie security: Secure, HttpOnly, and SameSite attributes

Cookies store sessions, tokens, and settings. Incorrectly configured attributes make them vulnerable to interception, theft through XSS, and CSRF attacks. The Secure, HttpOnly, and SameSite attributes significantly reduce these risks.

You can check your website’s cookie configuration using Cookie Analyzer and Security Headers on rechecker.ru.

Cookie attributes

Secure

The cookie is sent only over HTTPS. Over an HTTP connection, the browser does not send the cookie—this protects it from interception on unsecured networks.

Set-Cookie: session=abc123; Secure

Recommendation: always use Secure in production.

HttpOnly

The cookie is inaccessible to JavaScript. This protects against session theft through XSS: a script cannot read document.cookie.

Set-Cookie: session=abc123; HttpOnly; Secure

Recommendation: use HttpOnly for session and authentication cookies.

SameSite

Determines when a cookie is sent with cross-site requests.

Set-Cookie: session=abc123; SameSite=Strict; Secure; HttpOnly

In modern browsers, cookies without an explicit attribute default to SameSite=Lax.

Path and Domain

• Path=/ — the cookie is available on all paths
• Domain=example.com — for the domain and its subdomains (use caution: subdomains will have access)

Max-Age and Expires

The cookie’s lifetime. Max-Age in seconds is preferable to Expires.

Set-Cookie: session=abc123; Max-Age=3600; Secure; HttpOnly; SameSite=Strict

Recommended settings by cookie type

Session / authentication

Secure; HttpOnly; SameSite=Strict; Path=/

Maximum protection. If OAuth/SSO with redirects is required, use SameSite=Lax.

CSRF token

Secure; SameSite=Strict

Without HttpOnly: JavaScript must be able to read the token to send it with a form.

Analytics (first-party)

Secure; SameSite=Lax; Path=/

Third-party (widgets, advertising)

Secure; SameSite=None

Secure is required when using SameSite=None.

Threats and protection

XSS

An attacker injects a script that reads document.cookie and sends the session to their server.

Protection: HttpOnly — the cookie is inaccessible to JavaScript.

Traffic interception

Over HTTP, the cookie is transmitted in plain text.

Protection: Secure — transmission only over HTTPS.

CSRF

A request from another site (a form or img) is sent with the user’s cookie.

Protection: SameSite=Strict or Lax; additionally, use a CSRF token.

Session fixation

An attacker supplies a session ID they know.

Protection: change the session ID on login; use HttpOnly and Secure.

Configuration examples

Node.js (Express + cookie-session)

app.use(cookieSession({
  name: 'session',
  keys: ['secret-key'],
  maxAge: 24 * 60 * 60 * 1000,
  secure: true,
  httpOnly: true,
  sameSite: 'strict'
}));

PHP

setcookie('session', $sessionId, [
    'expires' => time() + 3600,
    'path' => '/',
    'domain' => '',
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Strict'
]);

Python (Flask)

response.set_cookie(
    'session',
    value=session_id,
    secure=True,
    httponly=True,
    samesite='Strict',
    max_age=3600
)

Nginx (proxy_cookie_path)

To set attributes when proxying:

proxy_cookie_path / "/; HTTPOnly; Secure; SameSite=Strict";

Checking

curl -I https://example.com

In the Set-Cookie headers, check for Secure, HttpOnly, and SameSite.

Online: Cookie Analyzer — analyze all cookies and get security and GDPR recommendations.

Compatibility

SameSite=None requires Secure. Without Secure, the browser may ignore the cookie.

Connection with GDPR

Legal aspects and cookie consent: Cookies and GDPR: how to configure cookie consent.