---
title: "Lock down session cookies · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/session-cookies
updated: 2026-10-20
licence: "All rights reserved"
---

# Lock down session cookies

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)
- Rule: Mark session cookies `HttpOnly`, `Secure` and `SameSite=Lax` or `Strict`. Issue a new session at login and end it at logout and after a time limit.
- How: Set the cookie flags in your session library. Name the cookie with the `__Host-` prefix, so a subdomain cannot set or replace it. Make a fresh session ID after login, so an ID set before login is worthless. Delete the session on the server at logout, and end idle sessions after a set time. See the [website cookie rule](https://agentwranglers.se/playbook/website/security/cookie-attributes).
- Check: Read the `Set-Cookie` header after login. It has all three flags, and the session ID differs from the one before login. After logout, the old cookie gets 401.

Example:

```http
Set-Cookie: __Host-session=AbC123; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=28800
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/session-cookies`.

- Previous: [Store passwords with a slow hash](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/password-storage)
- Next: [Block cross-site form posts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/cross-site-requests)
- [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)