How to add the Secure flag to a cookie
A cookie without the Secure flag can be sent over an unencrypted connection, where anyone listening on the network can steal the visitor's session.
How to fix it
Your web server
Where: wherever you set the cookie (app framework session config, or Set-Cookie header)
Add the Secure attribute when you set the cookie. Examples:
Set-Cookie: session=...; Secure; HttpOnly; SameSite=Lax
Express: res.cookie('session', v, { secure: true, httpOnly: true, sameSite: 'lax' })
Django: SESSION_COOKIE_SECURE = True / _HTTPONLY = True / _SAMESITE = 'Lax'
PHP: session_set_cookie_params(['secure'=>true,'httponly'=>true,'samesite'=>'Lax'])Set Secure on session/auth cookies so the cookie is only ever sent over HTTPS (never in cleartext).
How to confirm: Re-scan — the cookie-flag finding should clear.
Not sure your site needs this fix? A scan checks this and dozens of other things and shows what yours is missing.
Scan your site free