Score a session cookie on Secure, HttpOnly, SameSite, prefix, scope, lifetime and rotation, and list the flags you are missing.
Secure and HttpOnly carry the most weight because they close the two ways a cookie leaves the browser without the user acting: a plaintext request and an injected script. SameSite is scored on a sliding scale, and the lifetime term rewards short sessions since it directly bounds how long a stolen cookie is worth stealing. Session cookies are the credential for the rest of the visit, so a missing flag converts a minor bug elsewhere — one mixed-content request, one XSS — into account takeover.
Cookie Security
Cookie score = 20 Secure + 18 HttpOnly + SameSite (20 Strict, 14 Lax, 4 None, 0 unset) + 8 __Host- prefix + 6 no Domain attribute + 4 path scoping + 12 rotation on login + lifetime score (12 at ≤1 h down to 0 above a week) = 100.
Cookie score = 20 Secure + 18 HttpOnly + SameSite (20 Strict, 14 Lax, 4 None, 0 unset) + 8 __Host- prefix + 6 no Domain attribute + 4 path scoping + 12 rotation on login + lifetime score (12 at ≤1 h down to 0 above a week) = 100. Secure and HttpOnly carry the most weight because they close the two ways a cookie leaves the browser without the user acting: a plaintext request and an injected script. SameSite is scored on a sliding scale, and the lifetime term rewards short sessions since it directly bounds how long a stolen cookie is worth stealing.
Session cookies are the credential for the rest of the visit, so a missing flag converts a minor bug elsewhere — one mixed-content request, one XSS — into account takeover.
This calculator takes 8 inputs: Secure flag set, HttpOnly flag set, SameSite attribute, __Host- prefix used, No Domain attribute, so no subdomain sharing, Path scoped to the application root or narrower, Rotated on login and privilege change, Cookie lifetime. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
It makes the browser enforce the hardening for you: a cookie named __Host-session is only accepted if it is Secure, has no Domain attribute and has Path=/. That stops a compromised or attacker-controlled subdomain from overwriting your session cookie, which is a cookie-tossing attack that flags alone do not prevent.