Laravel
← Back to all checks

Security

Cookie security

Checks that your cookies carry the Secure, HttpOnly and SameSite flags, so session cookies cannot be stolen or sent along with forged requests.

How it works

Once a day, we request your page and inspect every cookie it sets:

  • HttpOnly: session cookies must not be readable by JavaScript, so a cross-site scripting bug cannot steal them.
  • Secure: on an HTTPS site, every cookie should only travel over HTTPS.
  • SameSite: every cookie should declare SameSite (Lax, Strict or None), which protects against cross-site request forgery.

CSRF token cookies (such as XSRF-TOKEN) are read by JavaScript on purpose, so they are not treated as session cookies.

Statuses

Status Meaning
OK Every cookie has the right flags, or the page sets no cookies.
Warning A non-session cookie is missing a flag, or we could not connect.
Failed A session cookie is missing HttpOnly or Secure.

By default you are notified of failures only.

Fixing common problems

  • Laravel: set SESSION_SECURE_COOKIE=true, and keep http_only set to true and same_site set to lax in config/session.php.
  • PHP: set session.cookie_secure, session.cookie_httponly and session.cookie_samesite in php.ini.
  • Cookies from a plugin or tracker: update the plugin, or configure it to set the flags.