Cookies without Secure/HttpOnly
Scan rule · RSC-SEC-008
- Security
- Severity: Medium
- CWE-614
Checks issued cookies for the Secure and HttpOnly flags.
Scan tier
- External scan (anonymous)
How to fix it
Issue session cookies with `Secure; HttpOnly; SameSite=Lax`.