Free Cookie Security Checker

Nginx

# Rewrite Set-Cookie from upstream to add secure flags
proxy_cookie_flags ~ secure httponly samesite=lax;

# Or set a cookie directly with all attributes
add_header Set-Cookie "session=$cookie_session; Path=/; Secure; HttpOnly; SameSite=Lax" always;

Apache

# Requires mod_headers
Header edit Set-Cookie ^(.*)$ "$1; Secure; HttpOnly; SameSite=Lax"

# Or for a specific cookie
Header always set Set-Cookie "session=abc123; Path=/; Secure; HttpOnly; SameSite=Strict"

Node.js (Express)

import express from "express"
import session from "express-session"

const app = express()

app.use(
  session({
    secret: process.env.SESSION_SECRET!,
    resave: false,
    saveUninitialized: false,
    cookie: {
      httpOnly: true,
      secure: true,
      sameSite: "lax",
      maxAge: 1000 * 60 * 60 * 24,
    },
  }),
)

// Or when setting a cookie manually
res.cookie("token", token, {
  httpOnly: true,
  secure: true,
  sameSite: "lax",
  path: "/",
})