Glossary
Cookie flags
The three settings that decide how safely a cookie travels.
What it means
A session cookie is the thing that keeps someone signed in. Three flags decide how well it is protected. Secure means it is only ever sent over HTTPS. HttpOnly means JavaScript cannot read it, so an injected script cannot steal it. SameSite controls whether it travels on requests started by other sites.
Defaults are not always right, and frameworks differ. A cookie without HttpOnly turns any scripting bug into an account takeover. A cookie without SameSite turns a link on another site into an action taken as your user.
A check reads the cookies your published app sets and reports the flags it sees, so this one is observable rather than declared. Setting them is a small change in the one place your app creates sessions.
Findings that use this term
Incidents where it mattered
No incident in the library maps to this one yet.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026