Direct answer
Cookie attributes constrain how a browser sends or exposes a cookie. Review Secure, HttpOnly, SameSite, Domain and Path together with the application's actual authentication and cross-site workflows.
Inventory the relevant cookies
Using a test account, identify which cookies establish the session and record their names, attributes and issuing host without capturing their values. Note cookies used before login, after login and after a privilege change.
Reference: OWASP Session Management Cheat Sheet.
Review transport and script access
Secure instructs browsers to send the cookie over HTTPS; HttpOnly prevents ordinary client-side JavaScript from reading it. Verify each attribute is present where appropriate and check that the entire sensitive journey uses HTTPS, including login and redirects.
- Inspect Set-Cookie on the actual response, not only a proxy configuration.
- Record the hostname and Domain and Path scope.
- Avoid exporting active cookies in screenshots.
Test cross-site behavior
SameSite affects when browsers include cookies in cross-site contexts and can change legitimate federated sign-in or embedded workflows. Agree the intended behavior and test supported browsers. SameSite is defense in depth and does not replace a suitable CSRF defense for state changes.
Confirm the application still works
After an attribute change, test login, logout, account settings and any documented cross-site integration. A narrower domain can reduce unnecessary exposure, but sibling-host dependencies need an owner-approved migration and functional validation.
Assessment limits
Browser behavior, cookie prefixes and cross-site requirements vary. Attribute review does not prove immunity to XSS, session theft or CSRF, and cookies may not be the only credentials in use.
Frequently asked questions
Does HttpOnly prevent all XSS impact?
No. It can prevent scripts reading the cookie, but injected scripts may still act through the user's browser and access page data.
Does SameSite replace a CSRF token?
Do not assume so. Its behavior depends on browser and request context; assess the application's complete CSRF defenses.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.