Secure and HttpOnly cookie flags: what they do and when to set them

Low

Some cookies on your homepage are set without the Secure or HttpOnly flag.

Why it matters

HttpOnly stops JavaScript (including injected scripts) from reading a cookie; Secure stops it from being sent over HTTP. Session/auth cookies need both. Some analytics or preference cookies legitimately need JS access.

Quick fix

For session/auth cookies set: Secure; HttpOnly; SameSite=Lax.
Ignore this for cookies that must be readable by your front-end (e.g. UI preferences).

Step by step

Set flags

Set-Cookie: session=...; Path=/; Secure; HttpOnly; SameSite=Lax

Prompt for your AI builder

Paste this into Lovable, Bolt, v0, Cursor or Replit, then review the changes before deploying.

Make sure every authentication/session cookie my app sets has Secure, HttpOnly and SameSite=Lax (or Strict).

References

MDN: Set-Cookie

Check your app

Run a free scan