Make session cookies HttpOnly
Why it matters
Scripts on the page can read a session cookie without HttpOnly, so any cross-site scripting bug lets an attacker steal the login. HttpOnly hides the cookie from JavaScript while the browser still sends it with requests.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Stage 1: check that no front-end code reads the session cookie with document.cookie. Single-page apps sometimes read a token cookie; move them to an HttpOnly session plus an API call, or keep only a separate non-secret CSRF cookie readable.
- Stage 2: turn on HttpOnly where the cookie is created. PHP sessions use session.cookie_httponly = 1; Django sets it for sessions by default (SESSION_COOKIE_HTTPONLY); Laravel http_only in config/session.php; Express sessions cookie: { httpOnly: true }. Then test logging in and out.
http
Set-Cookie: session=VALUE; Path=/; Secure; HttpOnly; SameSite=Lax Related
Scan your domain to see whether this applies to you.