Secure, HttpOnly, SameSite: which cookie flags actually stop an attack

A session cookie is the credential. Once someone else has it they are the user, with no password involved. Three flags decide how hard that is, and each stops a different attack — which is why setting two of them is not two thirds of the job.

Secure

Stops the cookie being sent over plain HTTP. Without it, one request to http:// — a typed address, an old link, an image in an email — puts the session on the wire in the clear for anyone on the path.

People assume HSTS covers this. It does, after the first visit. The first request from a browser that has never seen the site is the one HSTS cannot protect, and it is the one this flag is for.

HttpOnly

Stops JavaScript reading the cookie through document.cookie. This is the difference between a cross-site scripting bug that defaces a page and one that harvests every session that loads it.

It does not prevent XSS, and it does not stop an attacker acting as the user inside the page they have injected into. It stops them taking the session away and using it later, which is most of the value.

SameSite

Decides whether the cookie rides along on requests started by another site, which is the whole mechanism behind cross-site request forgery.

• Strict — never sent cross-site. Safest, and it means following a link from an email lands the user logged out.
• Lax — sent on top-level navigations, not on background requests or form posts from elsewhere. The modern browser default and the right answer for most sessions.
• None — always sent, and requires Secure. Only for cookies that genuinely have to work inside someone else's page.

How to validate

curl -sI https://example.com | grep -i set-cookie

Read every cookie, not just the session one. A single cookie with SameSite=None and no Secure is rejected outright by current browsers, which usually shows up as an intermittent logout nobody can reproduce.

Check the Domain attribute too. A cookie scoped to .example.com is sent to every subdomain, so any one of them — including a forgotten marketing host on somebody else's platform — can read the session.

How it helps your infrastructure

These three flags cost one line of configuration and remove three distinct attacks: passive capture on an unencrypted request, session theft through an injected script, and actions performed by another site on the user's behalf. Very little else in web security has that ratio.

The Website Scanner reports each cookie with its flags and says which attack each missing one leaves open.