Why cookie security matters

Cookies carry session tokens, authentication state, and user preferences. If an attacker can steal or manipulate a cookie, they can hijack user sessions, bypass authentication, or perform actions on behalf of the user.

Most cookie attacks exploit missing security flags. Setting the right flags takes minutes and blocks entire categories of attacks.

Essential cookie flags

Secure

The Secure flag ensures the cookie is only sent over HTTPS connections. Without it, an attacker on a shared network can intercept cookies sent over plain HTTP.

Set-Cookie: session=abc123; Secure

HttpOnly

The HttpOnly flag prevents JavaScript from accessing the cookie via document.cookie. This is the primary defense against cross-site scripting (XSS) attacks that try to steal session tokens.

Set-Cookie: session=abc123; HttpOnly

SameSite

The SameSite attribute controls when cookies are sent with cross-site requests. It is the main defense against cross-site request forgery (CSRF) attacks.

Set-Cookie: session=abc123; SameSite=Lax

For most session cookies, Lax provides the best balance of security and usability.

Path

The Path attribute limits which URL paths receive the cookie. Set it to the narrowest scope needed.

Domain

The Domain attribute controls which domains receive the cookie. Omitting it restricts the cookie to the exact origin. Setting it to your apex domain shares the cookie with all subdomains, which is a risk if any subdomain is compromised.

Max-Age and Expires

Set explicit expiration times. Session cookies (no expiry) are cleared when the browser closes, but persistent cookies live until their expiry date. Do not set unnecessarily long lifetimes.

Common mistakes

Recommended configuration

For a session cookie, use all flags together:

Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax; Path=/; Max-Age=86400

How to audit your cookies

Use CQwerty Shield's Cookie Checker to scan any website and see which cookies are set, what flags they use, and which security improvements are needed.

Key takeaways

Check your cookie security now