no-insecure-session-cookie

Why it matters

Astro session cookies are secure, HTTP-only, and same-site by default. Explicitly disabling those properties can expose a session identifier to client-side scripts, insecure transport, or cross-site requests.

See the difference

export default defineConfig({
  session: {
    cookie: {
      secure: false,
      httpOnly: false,
      sameSite: false,
    },
  },
})

export default defineConfig({
  session: {
    cookie: {
      secure: true,
      httpOnly: true,
      sameSite: 'lax',
    },
  },
})

Configure this check

Project audits are configured in doctor.config.ts:

export default {
  rules: {
    'astro-doctor/no-insecure-session-cookie': 'error',
  },
}

Use 'error', 'warn', or 'off'. The configuration guide covers presets and per-file overrides.

Keep exploring security

• no-set-htmlAvoid set:html to prevent cross-site scripting (XSS) vulnerabilities.
• no-public-secret-envWarn when PUBLIC_ environment variables appear to contain secrets.
• no-disabled-origin-checkKeep Astro's built-in CSRF origin check enabled.
• no-open-allowed-domainsConfigure explicit trusted host patterns instead of allowing every domain.
• require-action-input-schemaValidate untrusted Astro Action input before the handler runs.

Browse every rule and project audit