← All articles

Cookie Security: Correct Use of HttpOnly, Secure and SameSite

10 September 2026

Cookie Security: Correct Use of HttpOnly, Secure and SameSite

Cookies are how the web maintains state, and session cookies carry the user’s identity. That makes them a primary target: whoever captures a session cookie can impersonate the user. Three security flags and proper scope greatly reduce this risk.

The three critical flags

A session cookie should ideally be set like this:

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/
  • HttpOnly: the cookie cannot be read from JavaScript (document.cookie). Even with an XSS vulnerability, the attacker cannot steal the session cookie via script. Almost always required for session cookies.
  • Secure: the cookie is only sent over HTTPS, so a network eavesdropper on an unencrypted connection cannot see it.
  • SameSite: controls whether the cookie is sent on cross-site requests. Lax (the modern default) cuts off most CSRF; Strict is stricter.

Scope: Domain and Path

  • Domain: if omitted, the cookie goes only to the exact host that set it (more secure). A broad parent domain (Domain=.yoursite.com) spreads it to all subdomains, increasing risk if a vulnerable subdomain exists.
  • Path: usually Path=/ is fine; avoid unnecessarily broad scope.

Extra hardening with the __Host- prefix

Prefixing the cookie name with __Host- makes the browser enforce strict conditions: the cookie must be Secure, must not include Domain, and must have Path=/. This hardens against cross-subdomain movement and some fixation tricks.

Session management principles

  • Rotate the session id on login (against session fixation).
  • Invalidate the session server-side on logout and timeout; deleting the cookie alone is not enough.
  • Do not keep sensitive cookies alive longer than necessary.

Summary

A solid default for session cookies: HttpOnly + Secure + SameSite=Lax/Strict, narrow scope (no Domain, Path=/), and ideally the __Host- prefix. These settings make cookie theft (via XSS or network) and CSRF significantly harder.

Sources: MDN: Set-Cookie, OWASP Session Management Cheat Sheet.

CyberTestify’s scan checks your cookies’ security flags (HttpOnly/Secure/SameSite) deterministically from real responses — scan your external surface.