Cookie security check: Secure, HttpOnly and SameSite

Why it matters

Without Secure, a cookie can be sent over plain HTTP and intercepted. Without HttpOnly, any script running on the page can read it, which turns a small cross-site scripting bug into account takeover. Without SameSite, other sites can make requests that carry your users' cookies.

What this check looks at

• Every cookie set on up to five pages
• Secure (on HTTPS sites), HttpOnly on cookies that look like sessions or auth tokens, and SameSite

How to fix it

res.cookie("session", value, {
  secure: true,
  httpOnly: true,
  sameSite: "lax",
});

session.cookie_secure = 1
session.cookie_httponly = 1
session.cookie_samesite = "Lax"

SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = "Lax"
CSRF_COOKIE_SECURE = True

import { cookies } from "next/headers";

(await cookies()).set("session", value, {
  secure: true,
  httpOnly: true,
  sameSite: "lax",
});