Cookie security attributesWhat it checks and how to fix it

What it checks

Fetches the site root and inspects every Set-Cookie header for the Secure, HttpOnly and SameSite attributes. Fails when a session-like cookie (its name contains session, sid, auth or token) lacks HttpOnly, or a cookie uses SameSite=None without Secure; warns on any other missing attribute; passes when every cookie has all three, or when no cookie is set.

Why it matters

Secure keeps a cookie off unencrypted HTTP connections, HttpOnly stops JavaScript, and so any injected script, from reading it, and SameSite limits when the browser sends it on cross-site requests, which blunts CSRF. A session cookie without them is the shortest path to account takeover. Browsers also reject SameSite=None cookies that are not Secure.

How to fix it

Every cookie should be set like this, with HttpOnly dropped only for the few cookies your own JavaScript must read:

Set-Cookie: session_id=abc123; Path=/; Secure; HttpOnly; SameSite=Lax

Use SameSite=Lax by default, Strict for cookies never needed on links from other sites, and None; Secure only for cookies that must be sent in cross-site embeds.

# Rails: config/initializers/session_store.rb
Rails.application.config.session_store :cookie_store,
  key: "_app_session", secure: Rails.env.production?, httponly: true, same_site: :lax

# Cookies you set yourself
cookies[:remember_token] = { value: token, secure: true, httponly: true, same_site: :lax }

config.force_ssl = true also marks Rails cookies as Secure.

# nginx (1.19.3+), for cookies set by the proxied application
proxy_cookie_flags ~ secure httponly samesite=lax;

# Apache (mod_headers)
Header always edit Set-Cookie ^(.*)$ "$1; Secure; HttpOnly; SameSite=Lax"

Cookies set by Cloudflare itself (such as __cf_bm) already carry these attributes; fix the ones your application or third-party scripts set.