Security finding
A session cookie is missing a protective attribute
Security Warning Severity: Medium
Part of the audit Cookie security attributes. Finding id: security.cookieFlags.
What it costs you
Whoever holds a session cookie is logged in as that visitor.
What to do
Set the session cookie with Secure, HttpOnly and SameSite=Lax, without a Domain attribute, and with the shortest lifetime the site can live with.
What it checks
- Login cookie can travel over insecure connections
- Cookie readable by page scripts
- Cookie sent along with requests from other sites
- Cookie shared with too many subdomains
- Login stays valid for too long
How to fix it
Set the attributes where the cookie is created
Drop the Domain attribute
- Find where [name] is set and remove the Domain attribute. The cookie is then returned only to the host that set it.
- Keep it only when several subdomains share one login.
How to check: curl -sI [example url] | grep -i set-cookie
Shorten the session lifetime
- Find where [name] is set and lower its Max-Age or Expires.
- If the long lifetime is a deliberate keep-me-signed-in option, dismiss the finding.
How to check: curl -sI [example url] | grep -i set-cookie
Thresholds
| Name | Default | Meaning |
|---|---|---|
max_session_days | 30 | Longest acceptable lifetime of a session cookie, in days. Adjustable default; not taken from a standard. |