Cookie missing Secure flag on Next.js
One of your cookies is set without the `Secure` attribute. This means the browser will send it over plain HTTP — readable by anyone on the same Wi-Fi network. Every cookie on an HTTPS site should have `Secure`. The fix is one attribute in your `Set-Cookie` header: `; Secure`. Update wherever your app sets cookies (auth middleware, session library, framework config).
The fix for Next.js
Next.js cookies
When setting cookies in Route Handlers or middleware, always pass secure.
import { cookies } from 'next/headers';
const cookieStore = await cookies();
cookieStore.set({
name: 'session',
value: token,
httpOnly: true,
secure: true,
sameSite: 'lax',
path: '/',
maxAge: 60 * 60 * 24 * 7,
});Why it matters
Session cookies without Secure can be intercepted on public Wi-Fi and used to impersonate the user. HSTS helps but does not replace this — Secure is a defense at the cookie level.
Confirm the fix worked
Scan your Next.js site to confirm this finding is gone.
AI prompt
Apply across your codebase
Paste this into Cursor, Lovable, Bolt, v0, or Claude Code.
Audit every place my app sets cookies. For each cookie, add the Secure, HttpOnly, and SameSite=Lax attributes (or SameSite=Strict for auth cookies). Explain any cookie where I need JavaScript access and cannot use HttpOnly.FAQ
Frequently asked questions
- What about localhost?
- Secure cookies do work on localhost in modern browsers (Chrome 89+, Firefox 75+). If yours do not, set them conditionally based on NODE_ENV.
Related fix guides
Fix these too
Cookie missing HttpOnly
HttpOnly stops JavaScript from reading a cookie, which is critical for session tokens. Here is when and how to set it.
Read moreCookie missing SameSite
SameSite controls whether cookies are sent on cross-site requests — the main defense against CSRF. Here is how to set it.
Read moreMissing HSTS header
HSTS tells browsers to always use HTTPS for your site. Without it, users can be downgraded to HTTP and have sessions stolen. Here is how to add HSTS on Vercel, Next.js, and other hosts.
Read moreFree tools