Skip to content
astro-doctor
Securitywarn by defaultrecommended presetastro-doctor/no-insecure-session-cookie

no-insecure-session-cookie

Keep secure, HTTP-only, same-site session cookie protections enabled.

Why

Astro session cookies are secure, HTTP-only, and same-site by default. Explicitly disabling those properties can expose a session identifier to client-side scripts, insecure transport, or cross-site requests.

Examples

Incorrect

Session cookie protections disabled

typescript
export default defineConfig({
  session: {
    cookie: {
      secure: false,
      httpOnly: false,
      sameSite: false,
    },
  },
})

Correct

Keep the secure defaults

typescript
export default defineConfig({
  session: {
    cookie: {
      secure: true,
      httpOnly: true,
      sameSite: 'lax',
    },
  },
})

Configuration

Project audits are configured in doctor.config.ts:

typescriptdoctor.config.ts
export default {
            rules: {
              'astro-doctor/no-insecure-session-cookie': 'error', // or 'warn' or 'off'
            },
          }

All rules

Edit this page on GitHub ↗