Cookie Security Attributes: Secure, HttpOnly, and SameSite Explained
A cookie is set with a Set-Cookie response header, and that header can carry attributes that restrict how the browser is allowed to use it afterward. Three of them — Secure, HttpOnly, and SameSite — each close off a different way a cookie could otherwise leak or be misused, and none of the three substitutes for the others.
Last updated August 11, 2026.
What each attribute does
Secure — the browser will only send this cookie over an HTTPS connection. Without it, the same cookie is also sent over plain HTTP if the browser ever makes that request to the domain, which means it can be read by anyone positioned on that unencrypted connection.
HttpOnly — the browser will not expose this cookie to JavaScript running on the page (no document.cookieaccess). Without it, any script that runs on the page — including a compromised third-party widget or an XSS vulnerability — can read and exfiltrate the cookie's value.
SameSite — controls whether the browser attaches this cookie to a request that originated from a different site. Without it, older browser defaults send the cookie along even on requests triggered by another site — the mechanism behind CSRF (cross-site request forgery).
An example Set-Cookie header with all three
Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=Lax
SameSite=Lax is a reasonable default for most sites — it still allows the cookie on top-level navigation, so a visitor clicking a link into your site from elsewhere stays signed in, while blocking it on background cross-site requests. SameSite=Strict is tighter still, withholding the cookie even on that inbound navigation. SameSite=None is the opt-out, for cookies that genuinely need to be sent cross-site (an embedded widget your site serves on other domains, for example) — browsers require Secure to be set alongside None, or they reject the cookie outright.
Why session and auth cookies specifically need all three
A session or authentication cookie is, functionally, the thing that proves who a visitor is for the rest of their visit — anyone who can read it or cause it to be sent somewhere it shouldn't be can act as that visitor. Secure keeps it off unencrypted connections, HttpOnly keeps it out of reach of page scripts, and SameSite keeps it from being attached to requests another site triggered. Each attribute closes a different path to misusing the same cookie, which is why all three are expected together on a session cookie rather than treated as interchangeable options.