Access and accounts Required

Lock down session cookies

Mark session cookies HttpOnly, Secure and SameSite=Lax or Strict. Issue a new session at login and end it at logout and after a time limit.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Set the cookie flags in your session library. Name the cookie with the __Host- prefix, so a subdomain cannot set or replace it. Make a fresh session ID after login, so an ID set before login is worthless. Delete the session on the server at logout, and end idle sessions after a set time. See the website cookie rule.

Example

Set-Cookie: __Host-session=AbC123; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=28800

How to check

Read the Set-Cookie header after login. It has all three flags, and the session ID differs from the one before login. After logout, the old cookie gets 401.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/session-cookies.