Verify that all authentication and session cookies enforce HttpOnly, Secure, and SameSite attributes.
Audits Set-Cookie headers for missing Secure flags over HTTPS, missing HttpOnly flags on session tokens, and prefix compliance (__Host- and __Secure-).
Canonical test payload dispatched during security surface audits.
Set-Cookie: user_auth=abc; Path=/Watch the probe engine test this signature in an isolated sandbox.
Secure Cookie Attributes
res.cookie('token', token);res.cookie('token', token, { httpOnly: true, secure: true, sameSite: 'strict', path: '/' });Add HttpOnly to prevent JavaScript access and Secure to prevent plaintext transmission over HTTP.
Copy and paste into your editor to refactor this issue automatically.
Test your public domain specifically for Cookie Security & Flags Scanner.
Checks commonly evaluated alongside Cookie Security & Flags Scanner during surface discovery.
Verify anti-CSRF tokens, SameSite cookie policies, and origin validation on sensitive state-changing routes.
Detect sensitive tokens, passwords, or PII stored in unencrypted localStorage or sessionStorage.
Detect web cache poisoning, password reset link poisoning, and server-side routing hijack via spoofed Host headers.
Audit your site across all 41 vectors automatically on every deploy.