Cookies without locks

A cookie is a small piece of text your site asks the visitor's browser to hold on to and send back. Three optional settings control who else can get at it. Most sites leave all three off, which is how a cookie meant for you becomes a cookie for anybody.

Secure

Without it, the browser will send the cookie over an unencrypted connection. Anyone sharing a café or airport network can read it. In 2010 a browser extension called Firesheep made this trivial enough that a non-technical person could hijack strangers' logged-in sessions from the next table — which is what finally pushed the industry to encrypt everything.

HttpOnly

Without it, any JavaScript running on your page can read the cookie — including a script that got there by accident: a compromised plugin, an injected comment, a third-party tag whose owner changed. With it, the cookie is invisible to scripts and only ever travels between browser and server.

SameSite

Without it, the cookie is attached to requests that another website caused the visitor's browser to make. That's the mechanism behind cross-site request forgery: a visitor logged into your site visits somewhere else, that page quietly triggers a request to yours, and their browser helpfully includes their session. "Lax" is the sensible default; "Strict" for anything sensitive.

One caveat so the report doesn't mislead you: cookies set by services you don't control — your CDN, your consent manager, your payment provider — are configured by them, not you. We flag them so you know they're there, but the ones to fix are your own.

Sources

• MDN Web Docs — Set-Cookie and cookie attributes
• OWASP — Session Management Cheat Sheet
• Office of the Privacy Commissioner of Canada — Firesheep (2010)