Why it matters
A session cookie without HttpOnly can be stolen by any script on the page. Without Secure it can travel over plain http. Without SameSite it is sent on cross-site requests, which helps cross-site request forgery.
How Patch checks
We look at cookies set for your own domain after the page loads. We flag cookies without Secure on an HTTPS site, session-looking cookies without HttpOnly, and SameSite=None without Secure. Third-party cookies are judged under the consent checks instead.
How to fix it
- Set these flags on your cookies: Secure; HttpOnly (for anything a script doesn't need to read); SameSite=Lax.
- In most frameworks this is one setting on the session or cookie middleware.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Good security practice everywhere.