Cookie security check
Inspects Set-Cookie headers for Secure, HttpOnly, and SameSite flags — the three attributes that stop session hijacking in modern browsers.
Quick answer
Every Set-Cookie on your homepage and login page is checked for Secure, HttpOnly, and SameSite=Lax or Strict.
What it checks
- Secure flag (HTTPS-only)
- HttpOnly flag (blocks document.cookie access)
- SameSite=Lax or Strict
- Cookie prefixes (__Secure-, __Host-) bonus
Where to find it in Lemwatch
Site details → Security → Cookies.
How to fix
- Update your session cookie config: add Secure + HttpOnly + SameSite=Lax.
- For strictly first-party auth, prefer SameSite=Strict.
- Use the __Host- prefix for session cookies bound to the origin.
- Re-run the check.
FAQ
Will SameSite=Strict break OAuth?
It can — SameSite=Lax is safer for redirect-based auth.
What about tracking cookies?
Same flags apply — Google, Segment, etc. usually get this right.
Related