Make session cookies HttpOnly on Shopify
Why it matters
Scripts on the page can read a session cookie without HttpOnly, so any cross-site scripting bug lets an attacker steal the login. HttpOnly hides the cookie from JavaScript while the browser still sends it with requests.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
Not possible on Shopify. Shopify sets the storefront's own cookies and stores cannot change their attributes. If the cookie belongs to an installed app, ask the app's developer to fix it.
Related
Scan your domain to see whether this applies to you.