Checks · AUTH-007

AUTH-007 · Session cookie without HttpOnly, Secure or SameSite

Why it matters

A session cookie readable from script, or sent over plain HTTP, is easier to steal.

How we detect it

Set-Cookie on the live response is missing HttpOnly, Secure or SameSite.

How we fix it

Set HttpOnly, Secure and SameSite on the session cookie.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-008 · Hard-coded admin email or password
• AUTH-001 · Admin route without auth check
• AUTH-002 · Authorization by client-side flag only
• AUTH-003 · Supabase user_metadata used for roles