Session cookies have Secure and HttpOnly flags

Session cookies without Secure can be transmitted over plain HTTP if a downgrade or redirect is ever triggered, handing an attacker the session token in cleartext. Cookies without HttpOnly are readable by any JavaScript on the page — a single XSS payload is enough to exfiltrate the token to an attacker-controlled server. Together, these two flags prevent the most common session-theft vectors. OWASP A05 (Security Misconfiguration) and A07 (Identification and Authentication Failures) both flag missing cookie security attributes as prerequisites for session hijacking. CWE-614 and CWE-1004 explicitly name the absence of Secure and HttpOnly as exploitable defects.

Verify your auth library's cookie configuration explicitly sets both flags. Most libraries set them by default in production, but explicit config overrides defaults and survives library upgrades without silent regression.

// NextAuth.js — src/app/api/auth/[...nextauth]/route.ts or auth.ts
export const authOptions = {
  cookies: {
    sessionToken: {
      options: { httpOnly: true, secure: true, sameSite: 'lax' }
    }
  }
}

For manual Set-Cookie headers in API routes, append ; HttpOnly; Secure; SameSite=Lax to every cookie value. Search all API routes for Set-Cookie and document.cookie to find uncovered locations.