HttpOnly session cookies

What it checks

Whether session-like cookies have HttpOnly.

Why it matters

A script injected into a page can read a session cookie without HttpOnly and take over the session.

How to fix it

1. Add HttpOnly to every cookie the page's own scripts don't read, session cookies above all.

Set-Cookie: __Host-session=…; Path=/; Secure; HttpOnly; SameSite=Lax