Set secure flags on session cookies
Inspect session cookies across login, renewal, and logout. Record transport, script access, host scope, and cross-site behavior in one worksheet.
A session cookie deserves a separate configuration review from preference or analytics cookies. Identify the cookie that actually authenticates the request. A well-configured cookie with an unrelated name does not protect the credential that the application uses.
OWASP's session guidance explains the protection provided by Secure, HttpOnly, and cookie scope. Use the worksheet below to connect those controls to observed application behavior. It is a proposed review record, not a certification checklist.
Inventory every issuance path
Capture response headers in an authorized test environment. Cover initial login, session renewal, account switching, and logout. Include responses generated by an authentication proxy, not only the application server. Do not paste cookie values into the review record.
| Field | Record | Decision to explain |
|---|---|---|
| Name and issuer | Cookie name and response route | Which component owns it? |
| Secure | Present or absent | Is transport restricted to HTTPS? |
| HttpOnly | Present or absent | Does browser code need this value? |
| SameSite | Explicit setting | Which cross-site journeys must work? |
| Domain and Path | Effective scope | Is the credential sent more widely than needed? |
| Lifetime | Expiry and server timeout | When does authentication actually end? |
Record the effective browser result as well as the configured value. An edge layer can change a header after the application sets it. Duplicate cookie names with different paths can also make a screenshot misleading.
Check the journeys that could break
Use a dedicated test account for an external-link visit, an identity-provider return, and any approved embedded flow. Compare the request cookies and resulting session state. Choose the narrowest policy that supports the intended journey; do not weaken every cookie to fix one integration.
HttpOnly limits script access to the cookie value. It does not prevent an injected script from making authenticated requests. Keep output handling and CSRF defenses in the review scope. Likewise, a cookie expiration is not evidence that a separately copied server credential has been revoked.
Close the configuration gap
Assign each mismatch to the component that issues the header. Add assertions for every issuance path, including renewals after a deployment. Recheck logout for all path and domain variants that existed before the fix. Retain redacted header evidence, the tested build, browser version, and the expected cross-site outcomes. This makes the next authentication change reviewable without collecting live session secrets.
Find the gaps before your next launch
Use the release checklist to identify changed security boundaries and missing evidence. Discuss the application paths you want reviewed before launch.