Insecure Cookie Flags (Missing Secure or HttpOnly)

Low Severity Technical Guide

Vulnerability Description

Cookies that store sensitive data (like session tokens or auth state) are vulnerable to interception if they lack security flags. Without the Secure flag, cookies can be transmitted in cleartext over unencrypted HTTP connections. Without the HttpOnly flag, client-side scripts can access the cookie, making it vulnerable to theft via Cross-Site Scripting (XSS).

Remediation Guide

To resolve this vulnerability, follow these config changes or developer practices:

When setting sensitive session cookies, ensure you enforce Secure, HttpOnly, and SameSite flags: Set-Cookie: session_id=xyz123; Secure; HttpOnly; SameSite=Lax; Path=/; Domain=yourdomain.com

Verify Your Fix

After applying the remediation, run an external attack-surface scan to verify that the vulnerability is no longer detected by WebScanify.

Is your website vulnerable?

Run a free security scan now to identify missing headers, outdated JS, and other deployment vulnerabilities.