What is it?
This finding means one or more Set-Cookie headers are missing recommended browser protection flags such as Secure, HttpOnly, or SameSite. It belongs to HTTP header and session hardening.
Why does it matter?
Cookies often carry session identifiers or user preferences. Missing flags can make cookies easier to expose over plain HTTP, easier to read from injected JavaScript, or more likely to be sent in cross-site requests.
How to fix it?
Set the appropriate flags in your application session middleware, reverse proxy, or framework configuration.
Set-Cookie: session=...; Secure; HttpOnly; SameSite=LaxUse Secure for cookies that should only travel over HTTPS. Use HttpOnly for cookies that JavaScript does not need to read. Use SameSite=Lax as a practical default, or SameSite=None; Secure only when the cookie must be sent in third-party contexts.