Checks

Cookie missing Secure

A cookie set on an HTTPS response does not have the Secure attribute.

Why it matters

The browser may send that cookie if the user is later sent to HTTP, where it can be read on the network.

What to do

Add Secure to every cookie on HTTPS.

Reference

Cookie attributes such as Secure, HttpOnly, and SameSite protect session tokens in browsers.

OWASP Session Management Cheat Sheet