Cookie Security Checker

Check whether website cookies use security attributes such as Secure, HttpOnly, SameSite, path, domain, and expiry controls.

Review cookie settings Read docs

Problem Summary

Cookies often carry session identifiers, preferences, and application state. Missing cookie attributes can increase exposure if another vulnerability, network weakness, or cross-site request path is present.

Why It Matters

Secure helps keep cookies off cleartext HTTP requests.
HttpOnly reduces direct JavaScript access to sensitive cookies.
SameSite can reduce some cross-site request patterns when configured for the application flow.
Broad domain and path settings can expose cookies to more hosts or routes than intended.

How Qourby Checks It

Requests public pages and records Set-Cookie headers returned during the scan.
Checks whether cookies include expected attributes and flags common risky combinations.
Reports the cookie name, endpoint, and observed attributes where available.
This is not a manual authentication test and does not prove session fixation, CSRF, or account takeover by itself.

Basic scanning checks externally observable configuration and response behavior. Manual penetration testing goes further with authenticated flows, exploit validation, source review, business logic testing, and human judgment.

Common Failures

Session cookies missing Secure on HTTPS sites.
Sensitive cookies missing HttpOnly.
SameSite omitted where the application does not require broad cross-site behavior.
Cookie Domain scoped too broadly across subdomains.
Long-lived cookies used where shorter expiry or rotation would be more appropriate.

How To Fix

Set Secure and HttpOnly on session cookies unless a specific technical reason prevents it.
Choose SameSite=Lax or SameSite=Strict for cookies that do not need third-party context.
Use SameSite=None only with Secure and only where cross-site embedding or identity flows require it.
Scope Domain and Path to the narrowest practical host and route.
Review framework defaults and edge middleware that may rewrite cookies.

Related Checks and Guides

Scanner check