https://shipreadyai.dev/learn/findings/o9-cookie-flags

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# A cookie is missing a protective flag

A cookie without Secure can travel over a plain connection, and one without HttpOnly can be read by any script on the page.

## Why AI-built apps get this

Session cookies come from whatever library the agent reached for, with whatever defaults it ships. Secure, HttpOnly and SameSite are three small settings that turn a scripting bug into an account takeover when they are missing, and nothing in your app looks wrong when they are.

## Evidence line

set-cookie: session=abc; Path=/ with no HttpOnly and no SameSite

## The fix

Set Secure, HttpOnly, and a SameSite value on the cookie where you create it. Cookie {name} is missing {missing}.

## Prompt

The cookie {name} is missing {missing}. Add the Secure, HttpOnly, and SameSite attributes where you create it.