Cookie Security Flags: How to Fix Misconfigured Cookies | Acunetix

Cookie Security Flags: How to Fix Misconfigured Cookies

This article was originally published by LOGON’s partner Acunetix. Click here to view the original article.

Most session cookies are misconfigured. The problem? Browsers accept insecure cookies without warnings, and security flags are opt-in, not enforced.

The secure baseline every session cookie needs:

Set-Cookie: sessionid=abc123; HttpOnly; Secure; SameSite=Strict

What each flag does:

Flag	Purpose
HttpOnly	Prevents JavaScript from reading the cookie (stops XSS cookie theft)
Secure	Ensures cookies are only sent over HTTPS (prevents interception)
SameSite=Strict	Blocks cross-site cookie sending (mitigates CSRF attacks)

Quick fixes by framework:

Node.js/Express: res.cookie('sessionid', 'abc123', { httpOnly: true, secure: true, sameSite: 'strict' })
Python/Django: Enable SESSION_COOKIE_SECURE and SESSION_COOKIE_HTTPONLY in settings
PHP (7.3+): setcookie('sessionid', 'abc123', ['httponly' => true, 'secure' => true, 'samesite' => 'Strict'])

Remember: Cookie flags reduce risk but don’t fix underlying vulnerabilities like XSS or CSRF. You still need proper security testing to find the root causes.

Want to check if your cookies are secure?

LOGON Software Asia – the trusted Acunetix distributor in Asia – offers:

✅ Free Proof of Concept (POC)
✅ Preferred regional pricing
✅ Priority technical support

Find, fix, and prevent vulnerabilities

Acunetix is an application security testing solution for securing your websites, web applications, and APIs

Solution Highlight

Get started with Acunetix

Book a live demo with our specialist to discover how Acunetix can quickly find and fix the vulnerabilities that put your web applications at risk of attack.

Acunetix Blog, Blog