HttpOnly, Secure, and SameSite are cookie flags that restrict how a browser is allowed to handle a cookie. A session cookie missing HttpOnly can be read by any JavaScript running on the page — including injected malicious scripts — and stolen outright. Missing Secure means the cookie can be sent over plain, unencrypted HTTP. Missing SameSite makes the cookie easier to leverage in cross-site request forgery, since it will be sent along with requests originating from other sites.
What each flag actually blocks
HttpOnly stops any client-side JavaScript, including an attacker's injected script from a cross-site scripting bug, from reading document.cookie and exfiltrating the session token. Secure stops the browser from ever transmitting the cookie over an unencrypted connection, closing off interception on shared networks. SameSite (Lax or Strict) stops the browser from attaching the cookie to requests that originate from a different site, which limits how a cross-site request forgery attack can use a logged-in user's session against them.
Why generated auth code often misses these
Session cookies work identically in local development whether or not these flags are set — a missing Secure flag doesn't break anything on localhost over HTTP, and a missing HttpOnly flag doesn't break anything unless something is actively exploiting it. Framework and library defaults vary, and code scaffolded quickly for a demo often keeps the simplest cookie configuration rather than the hardened one.
How to fix it
Set all three flags on every cookie that carries a session, auth token, or CSRF token: HttpOnly; Secure; SameSite=Lax (or Strict for more sensitive flows). In most auth libraries and frameworks these are configuration options on the session or cookie setup, not something you set manually per request.
Frequently asked
Which of the three flags matters most if I can only fix one?
HttpOnly and Secure are generally treated as the higher-severity gaps, since either one alone can lead directly to session theft. SameSite reduces CSRF exposure, which is real but typically has more mitigations available elsewhere in an app (CSRF tokens, origin checks).