Add the Secure flag to cookies
Why it matters
A cookie without Secure is also sent over plain http, where anyone on the network can read it and, for a session cookie, take over the visitor's account. Secure keeps it to HTTPS connections.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Find the code or setting that creates each cookie named in the finding: the framework's session settings, your own code, or a plugin.
- Stage 1: make sure every page that uses the cookie (login, account, checkout, other subdomains sharing it) works over https, and that http redirects to https.
- Stage 2: turn on Secure where the cookie is created. PHP sessions use the php.ini lines below; Django SESSION_COOKIE_SECURE = True and CSRF_COOKIE_SECURE = True; Laravel SESSION_SECURE_COOKIE=true; Express sessions cookie: { secure: true } with app.set('trust proxy', 1) behind a proxy.
- Test logging in, logging out and checkout. Browsers replace the old cookie the next time the site sets it.
php.ini
; php.ini (or your host's PHP settings): flags for PHP session cookies session.cookie_secure = 1 session.cookie_httponly = 1 session.cookie_samesite = "Lax"
Related
Scan your domain to see whether this applies to you.