Cookie security monitoring explained
What it is
Cookie security means setting the right attributes on session and auth cookies: Secure (only over HTTPS), HttpOnly (not readable by JavaScript), and SameSite (limits cross-site sending). Monitoring checks that your Set-Cookie headers include these attributes.
Why it matters
Cookies without Secure can be sent over HTTP and intercepted. Without HttpOnly, XSS can steal session tokens. Without SameSite, cross-site requests can carry the cookie (CSRF risk). Monitoring catches cookies that are missing these attributes so you can fix them before an incident.
How Barrion checks it
Barrion inspects Set-Cookie response headers from your app. We report cookies that lack Secure, HttpOnly, or SameSite (or use SameSite=None without Secure). Each finding includes which attribute is missing and how to fix it. Scans are passive and do not modify cookies.
