Visible Cookie Flags Check
Explain the limited public evidence FreeScan can collect when a page sets cookies.
Check your websiteWhy this check matters
Secure, HttpOnly, and SameSite attributes reduce common cookie risks. FreeScan reports this as informational when the safe public header allowlist cannot verify every attribute.
Passing evidence
Set-Cookie: session=…; Secure; HttpOnly; SameSite=LaxCommon failing evidence
Set-Cookie: session=…; Path=/Possible false positives
- A CDN may set a harmless public cookie separately from the application session.
- Cookie headers may be intentionally omitted from saved public audit evidence.
How to fix it safely
- Classify each cookie by purpose and sensitivity.
- Apply Secure and an appropriate SameSite policy to production cookies.
- Use HttpOnly for cookies that client JavaScript does not need.
How to verify the fix
- Inspect cookies in browser storage after exercising the relevant flow.
- Confirm attributes on the actual response that creates each cookie.
Related Security checks
Run the complete audit
Check this signal together with the related category evidence on the current public page.
Open the security audit tool
