HttpOnly, Secure, and SameSite
Three words that decide how bad a script injection turns out to be.
HttpOnly is the important one
Without it, any script running on your page can read the session cookie — including a script injected through a comment field, a user-supplied name, or a compromised third-party analytics tag. With it, that same bug leaks nothing, because JavaScript simply cannot see the cookie.
This is the difference between "someone found an injection bug" and "someone took over accounts".
The full set
httpOnly: true — JavaScript cannot read it. secure: true — only sent over HTTPS. sameSite: "lax" — not sent on cross-site requests, which blocks most CSRF. path: "/" — scoped sensibly.
If you set SameSite=None you MUST also set Secure, or browsers discard the cookie entirely. That combination usually shows up as a login that silently fails for some users.
If your code reads the cookie
Some frontends read the session from document.cookie to work out whether the user is logged in. Replace that with a call to a server endpoint that returns the current user — then the cookie can be HttpOnly and nothing breaks.
Not sure whether this applies to you?
Give us the address and we will tell you. No code, no access, no install — and every finding we have is shown in full, including on the free trial.
Check a site