Protection of cookies

What we check

We read the Set-Cookie headers with which the server sets cookies while the home page loads, including files loaded later and background requests. Cookies from foreign domains are left out.

• Secure missing on a cookie of an HTTPS page: warning.
• HttpOnly missing on a cookie whose name points to a session, a login or a token (PHPSESSID, wordpress_logged_in_…, csrf, auth, …): warning.
• SameSite missing: note.

If the server sets no cookies, there is nothing to flag.

Why it matters

A cookie is a small ID card the browser sends along with every request. For the session cookie of a login: whoever has it is logged in. Three attributes decide to whom the browser shows that card.

• Secure: only over encrypted connections. Without the attribute the cookie also goes along with a request to http://example.ch, where it can be read in an open Wi-Fi.
• HttpOnly: only to the server, not to the scripts of the page. If someone manages to inject script code (cross-site scripting), they still cannot read the cookie.
• SameSite: not with requests that start from foreign websites. This prevents another site from triggering actions in the name of a logged-in visitor (cross-site request forgery). Browsers mostly assume Lax without the attribute, but not all in the same way.

None of the attributes costs anything, and they rule out whole classes of attacks.

How to fix it

PHP applications

In php.ini or in the application:

session.cookie_secure = 1
session.cookie_httponly = 1
session.cookie_samesite = "Lax"

WordPress

WordPress sets HttpOnly on its login cookies itself, and Secure as soon as the site address starts with https://. Missing attributes then usually come from a plugin or the theme. Hosting panels and security plugins often offer a switch for SameSite.

Web server

Nginx can add attributes afterwards:

proxy_cookie_flags ~ secure httponly samesite=lax;

With Apache, Header edit Set-Cookie ^(.*)$ "$1; Secure; HttpOnly; SameSite=Lax" does the same job. It is better, though, to configure the application itself correctly.

How to check it yourself

Open the developer tools (F12), tab "Application" (Chrome) or "Storage" (Firefox), then "Cookies". The columns "Secure", "HttpOnly" and "SameSite" show the attributes of every cookie.

Frequently asked questions

What does this have to do with the cookie banner?

Nothing. The banner decides whether statistics and advertising cookies may be set. This is about how well the cookies that the website sets itself are protected against theft and misuse, such as the session cookie of a login or shopping cart.

Why do cookies from third parties not count?

Their attributes are set by the provider, not by the operator of the website. We only rate cookies that come from the domain of the website itself.

The cookie tool needs access via JavaScript. Is HttpOnly wrong then?

For a cookie that only stores the consent, missing HttpOnly is not a problem. We only flag it for cookies whose name points to a session or a login.