# How to set Secure, HttpOnly and SameSite on cookies

> Three cookie attributes stop cookies from leaking over HTTP, being read by scripts or being sent in cross-site requests.

Security · HTML version: https://getreport.app/learn/cookie-flags

## Secure flag on cookies

Passing looks like: Secure flag on cookies passes.

**Why it matters.** Without Secure, the browser also sends the cookie over plain http://, where anyone on the network can copy it and take over the session.

**How to fix it.**

1. Add the Secure attribute to every Set-Cookie header (PHP: session.cookie_secure = 1; Express: cookie: { secure: true }).

## HttpOnly flag on cookies

Passing looks like: HttpOnly flag on cookies passes.

**Why it matters.** Without HttpOnly, any script on the page, including an injected one, can read the cookie and send the session somewhere else.

**How to fix it.**

1. Add HttpOnly to every cookie that JavaScript does not need to read; session cookies first.

## SameSite attribute on cookies

Passing looks like: SameSite attribute on cookies passes.

**Why it matters.** Without SameSite, the browser attaches the cookie to requests that other sites trigger, which is how cross-site request forgery works. Browsers apply different defaults, so say it explicitly.

**How to fix it.**

1. Add SameSite=Lax (or Strict) to every cookie.
2. Use SameSite=None together with Secure only for cookies a third-party embed genuinely needs.

Check your own page: https://getreport.app/