Proper Set-Cookie Implementation

Set-Cookie provides information for setting cookies. The Set-Cookie header is defined in RFC-6265.

Cookies that do not contain sensitive information and are outside the control of the website owner are ignored. For more information, check the Cookie Assessment Exclusion.

Optional for: HTTPS and HTTP

Configuration

• For HTTPS connections (if present) to be graded GOOD, Set-Cookie should be secure.
• For HTTP connections:
  • No headers are graded unless Set-Cookie is defined and the finding grade defaults to NEUTRAL.
  • The secure directive is not required when Set-Cookie is present.
• The HttpOnly and Secure attributes for secure cookies are not evaluated since they are not user-configurable and do not contain sensitive information. These are treated as prefixes.
• Cookies that begin with the same name (e.g., AWSALB ➔ AWSALBCORS) are ignored.

See how Web Application Headers is assessed and see finding messages if Set-Cookie is not properly implemented.