# Insecure cookies

> An insecure cookie is a cookie set without the Secure, HttpOnly or SameSite attribute, which leaves it open to theft or misuse by other sites.

- **Check ID:** SEC10
- **Area:** [Security](https://be1st.ai/glossary/security)
- **Tool:** [SEO + Security + Performance](https://be1st.ai/tools/ssp-audit)
- **Page:** https://be1st.ai/glossary/security/insecure-cookies

## Why it matters

A cookie without the Secure attribute is also sent over HTTP, where an attacker can intercept it. Without HttpOnly, it can be stolen via an XSS attack through JavaScript cookie access. Without SameSite=Strict or Lax, an attacker can craft a CSRF attack: a fake form that automatically sends a request with the victim's cookie.

## In practice

Stripe Dashboard sets its session cookie with all three attributes: Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax. Conversely, a website without these attributes risks an attacker stealing the session cookie via XSS and taking over the user's account.

## How be1st checks it

Checks whether cookies have the required security attributes set: Secure (sent only over HTTPS), HttpOnly (inaccessible via JavaScript), and SameSite (protection against CSRF attacks). Missing attributes create serious security vulnerabilities.

[SEO + Security + Performance](https://be1st.ai/tools/ssp-audit), Security tab.

Every check ends as: Pass, Warning, Fail.

## Sources

- [Set-Cookie header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie) (MDN)
- [Secure cookie configuration](https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/Cookies) (MDN)

## Related terms

- [HTTPS (security)](https://be1st.ai/glossary/security/https): HTTPS is HTTP encrypted with TLS. It keeps passwords, forms and cookies private on the way between the visitor and the server.
- [Deprecated APIs](https://be1st.ai/glossary/security/deprecated-apis): Deprecated APIs are browser features that are being phased out. Code that still uses them can stop working once browsers remove them.
- [Strict-Transport-Security (HSTS)](https://be1st.ai/glossary/security/strict-transport-security-hsts): Strict-Transport-Security (HSTS) is an HTTP header that tells browsers to use a website only over HTTPS for a set time, even when someone types or links http://.
- [Content-Security-Policy (CSP)](https://be1st.ai/glossary/security/content-security-policy-csp): Content-Security-Policy (CSP) is an HTTP header that lists the sources a page may load scripts, styles, images and frames from. It is the main defence against XSS.
- [X-Frame-Options](https://be1st.ai/glossary/security/x-frame-options): X-Frame-Options is an HTTP header that decides whether other websites may embed your page in a frame. It protects visitors against clickjacking.
- [X-Content-Type-Options](https://be1st.ai/glossary/security/x-content-type-options): X-Content-Type-Options: nosniff is an HTTP header that stops browsers from guessing a file's type, so a file cannot run as something it was not sent as.