Session-like cookie is missing the Secure attribute
ShipReady found a session-like cookie in a Set-Cookie response header without the Secure attribute.
Why it matters
Secure instructs browsers to send a cookie only over HTTPS. It is a transport constraint, distinct from whether page JavaScript can read the cookie.
How ShipReady detects it
What it inspects
ShipReady reads Set-Cookie headers from responses it already fetched and considers only names matching its session-like naming rules. It excludes CSRF, redirect, preference, consent, and similar non-session markers.
What triggers a finding
The rule triggers when a qualifying cookie header lacks the literal Secure attribute.
What the evidence shows
The observed response set the named qualifying cookie without Secure. The report includes the cookie name and never its value.
Limits of this check
ShipReady does not inspect every route, browser cookie state, HTTPS deployment, HSTS behavior, or whether the cookie authenticates a user. Missing Secure alone does not prove interception or account compromise.
How to fix it
Set Secure for session cookies
Configure the session-cookie response to include Secure in production and ensure the intended site is served over HTTPS.
Review each session-like cookie
Confirm the cookie purpose and attributes individually; cookies with different roles may require different handling.
How to verify the change
Inspect the deployed Set-Cookie header
Exercise the route that creates the session and inspect its response headers without recording cookie values.
Expected: The intended session cookie includes Secure.