Skip to content
Software development
ASD ISMISM-2063

ASD ISM 2063 Ensure web app cookies have security flags

What it says

If supported, web application session cookies set the HttpOnly flag, Secure flag and the SameSite flag by default.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Web apps should use secure cookie settings to protect user sessions.

Web applications often need to use small pieces of data called cookies to keep track of users and their sessions. To protect these sessions from bad actors, we need to make sure these cookies are set up correctly with certain 'flags.' If these flags aren't set, cybercriminals could potentially steal session information, leading to sensitive data loss or unauthorised access.

Why it matters

Without HttpOnly, Secure and SameSite cookie flags, sessions can be stolen via XSS/MitM/CSRF, enabling unauthorised access and data breaches.

How to implement

  1. Web developers should configure cookies with the HttpOnly flag to add an extra layer of security.

    This can be done by specifying 'HttpOnly' in the cookie settings so that the cookies cannot be accessed by malicious scripts running in the user's browser.

  2. Website administrators need to ensure the Secure flag is set on cookies, especially if the site supports HTTPS.

    This involves configuring server settings to only allow cookies to be transmitted over secure connections (HTTPS), preventing them from being exposed over insecure links.

  3. Developers should set the SameSite attribute on cookies to control the sharing of cookie data with external sites.

    This can be done by adding 'SameSite=Strict' or 'SameSite=Lax' to the cookie parameters to prevent cross-site request forgery, a type of malicious exploit.

  4. IT managers should implement periodic reviews of cookie settings to ensure all new and existing cookies comply with these flags.

    This can involve setting up automated scans or manual audits of the application's cookie configurations.

  5. Security teams should work with web developers to understand these settings and reinforce training on why they are important.

    This can be achieved through workshops and regular briefings to keep the team updated on best practices and risks involved.

Keep it running

Test all session cookies default to HttpOnly, Secure and SameSite; validate after releases and via scanner checks that flags aren't removed or downgraded.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The cookie configuration documentation for the web app: Check that it describes settings like HttpOnly, Secure, and SameSite flags.

    Good evidence

    Document includes comprehensive settings with explanations of each flag used.

  2. Check 2 of 5What an auditor asks for

    Look at

    Whether these reports have flagged any cookie misconfigurations.

    Good evidence

    Shows no issues identified with cookie security settings or that identified issues were promptly addressed.

  3. Check 3 of 5What an auditor asks for

    Ask for

    The IT team to demonstrate cookie settings in the web server or code configuration: Observe if the cookies are set with the correct security flags (HttpOnly, Secure, SameSite).

    Good evidence

    Demonstration will show these flags being applied consistently across all cookies.

  4. Check 4 of 5What an auditor asks for

    Look at

    Records of training sessions focusing on cookie security and best practices.

    Good evidence

    Record includes date, trainers, topics covered, and attendees.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Evidence of automated or manual cookie audits over the past year.

    Look at

    Audit logs showing regular checks of cookie security settings.

    Good evidence

    Audit log is detailed, showing dates, personnel involved, and findings.

Mappings

Closest match in ISO/IEC 27001: A.8.26, Defining security requirements for applications, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.26Defining security requirements for applicationsPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.