FALKEN'S MAZE / CHECKS / COOKIE FLAGS

Cookie flags

What Joshua checks

Checks the Secure, HttpOnly and SameSite flags on cookies the home page sets.

Why it matters

Cookies without these flags can travel over plain HTTP, be read by injected scripts, or ride along on requests from other sites.

How to fix it

Set Secure, HttpOnly and SameSite=Lax on every cookie, leaving HttpOnly off only for cookies your own scripts read.

In the Maze Score

Worth

5 points (half for a warning)

Severity

Medium

Runs on

Every scan, including the free report card

Related checks

• Content-Security-PolicyFree
• Clickjacking protectionFree
• Referrer-PolicyFree
• Permissions-PolicyFree
• X-Content-Type-OptionsFree