The cookie has no Secure attribute.

COOKIE_NO_SECURE · Severity: Warning

• WarningCOOKIE_NO_SECURE

  The cookie has no Secure attribute.

  Without Secure the browser also sends the cookie over plain HTTP, where it can be read or changed on the way. Only the cookie's name is shown, never its value.

  Recommendation: Add the Secure attribute.

Reported by

• Set-Cookie parser

Available through the API

• Set-Cookie parser API

Related findings

• Info COOKIE_NO_SAMESITE The cookie has no SameSite attribute.
• Info COOKIE_NO_HTTPONLY The cookie can be read by scripts (no HttpOnly attribute).
• Warning COOKIE_NOT_SECURE The HTTPS site sets a cookie without the Secure attribute.
• Error COOKIE_INVALID The Set-Cookie value has no valid name=value pair.
• Info COOKIE_LONG_LIFETIME The cookie asks to live longer than the 400 days browsers allow.
• Info COOKIE_MULTIPLE The text holds more than one cookie; only the first was checked.

All findings