Medium severity · Next.js

Cookie missing HttpOnly on Next.js

Your session or auth cookie is missing the `HttpOnly` attribute. Without it, any JavaScript running on your site can read the cookie — including malicious scripts injected via XSS. For session tokens, JWTs, or CSRF tokens, HttpOnly should always be set. The fix is one attribute: `; HttpOnly`. Add it wherever you set cookies.

The fix for Next.js

Next.js

Set httpOnly: true on every session/auth cookie.

cookies().set({
  name: 'session',
  value: token,
  httpOnly: true,
  secure: true,
  sameSite: 'lax',
});

Why it matters

HttpOnly is the defense that assumes XSS will happen. Even if an attacker injects a script, they cannot exfiltrate a cookie marked HttpOnly. CSP plus HttpOnly cookies is the gold standard.

Confirm the fix worked

Scan your Next.js site to confirm this finding is gone.

AI prompt

Apply across your codebase

Paste this into Cursor, Lovable, Bolt, v0, or Claude Code.

Find every place my app sets cookies. For cookies that store session tokens, JWTs, or auth state, add HttpOnly. For cookies that my client-side code needs to read (user preferences, theme), leave HttpOnly off but tell me which ones those are and confirm they do not contain sensitive data.

FAQ

Frequently asked questions

My frontend reads the JWT from the cookie — what do I do?
Stop. Keep the JWT server-side-only. Have your API read the cookie via `cookies()` in route handlers and return just the data the frontend needs. The frontend never needs the raw token.