HTTP security header
Set-Cookie (security attributes)
The Set-Cookie header's security attributes determine how safely session cookies are handled. HttpOnly blocks JavaScript access (limiting XSS-based theft), Secure restricts cookies to HTTPS, and SameSite mitigates CSRF by controlling cross-site sending. Correct cookie flags are foundational to session security.
Example
Set-Cookie: sid=...; HttpOnly; Secure; SameSite=Lax; Path=/Configuration guidance
- Always set HttpOnly and Secure on session cookies.
- Use SameSite=Lax or Strict as the flow allows.
- Scope with Path and a specific Domain; keep lifetimes short.
Helps mitigate
Related headers
Impactr finds and proves whether flaws like this are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.