Session cookies

Three flags decide who can read a login cookie.

What it is

A session cookie can carry the flags Secure (https only), HttpOnly (hidden from scripts) and SameSite (limits sending from other sites).

Why it matters

Without HttpOnly, a script injected into the page can read the login cookie. Without Secure, the cookie travels over plain http. Without SameSite, other sites can trigger requests with it. Tenty rates the finding medium when Secure or HttpOnly is missing and low when only SameSite is.

How Tenty checks it

Tenty reads the Set-Cookie headers of your page and checks the cookies whose names look like sessions or tokens.

How to fix it

Set Secure; HttpOnly; SameSite=Lax on session cookies in the settings of your framework or auth library.

How to reproduce

curl -sSI 'https://YOUR-APP/' | grep -i set-cookie

The flags appear after the cookie value.