Session cookie uses SameSite=None without Secure
A session-like cookie asks for cross-site use but lacks Secure.
Why it matters
Browsers reject cookies that combine SameSite=None with no Secure attribute. If the cookie carries a session, the application may appear to lose that session. The missing Secure flag also leaves the cookie eligible for transmission over unencrypted HTTP.
How ShipReady detects it
What it inspects
ShipReady inspects Set-Cookie headers on fetched pages. It considers cookie names containing session, token, auth, sid, jwt, user, or login, except names classified as CSRF/XSRF or callback, redirect, preference, locale, consent, or theme cookies.
What triggers a finding
For a considered cookie, the rule triggers when its parsed SameSite attribute is None and its raw Set-Cookie attributes do not include Secure.
What the evidence shows
A fetched response set a cookie whose name matched the scanner’s session-name heuristic and whose header contained SameSite=None without Secure.
Limits of this check
The name heuristic does not establish that the cookie actually authenticates a user. The scanner only sees Set-Cookie headers on pages it fetched; it does not run browser JavaScript or inspect cookies set later, authenticated flows, or routes outside the scan. A finding establishes the observed header combination, not that a login failure has occurred.
How to fix it
Choose cookie attributes for the intended use
If the cookie must be sent cross-site, keep SameSite=None and add Secure; serve it over HTTPS.
If cross-site sending is unnecessary, choose a stricter SameSite policy such as Lax where the application flow permits it. Test the affected flow in supported browsers.
How to verify the change
Inspect the response and test the flow
Inspect the response that sets the cookie, then exercise the relevant sign-in or cross-site flow in a browser.
Expected: The cookie has an intentional SameSite policy, Secure is present when SameSite=None is used, and the application flow works in supported browsers.
Cross-site cookie attributes
A cookie intended for cross-site use includes Secure and is served over HTTPS.
Set-Cookie: session_id=example; Path=/; SameSite=None; Secure; HttpOnly
The header contains both SameSite=None and Secure. The example value is only illustrative.