Session Configuration Check: What StackShield Tests

What this check looks for

StackShield inspects the attributes your application sets on its session cookie: HttpOnly, Secure and SameSite, plus signals about session lifetime and how the cookie is scoped. These are read straight from the Set-Cookie header, the same header the browser acts on.

Why it matters

The session cookie is the credential that keeps a user logged in. Its attributes decide how well it is protected. HttpOnly stops JavaScript from reading it, which is the barrier between a cross-site scripting bug and full session theft. Secure ensures it is only ever sent over HTTPS, closing the window where it leaks over an unencrypted request. SameSite limits when the cookie is sent on cross-site requests, which blunts CSRF.

These attributes cost nothing and are easy to get wrong, especially SameSite, whose default behaviour has shifted across framework and browser versions, and Secure, which is sometimes left off because it complicated local development and was never re-enabled.

What a failed check means

A failed check means the session cookie is missing one of these protections, most often Secure or a safe SameSite value. Each gap widens a specific attack: a missing HttpOnly makes XSS far more damaging, a missing Secure risks interception, a lax SameSite eases CSRF.

The fix is setting the session cookie to HttpOnly, Secure and an appropriate SameSite value in config/session.php, covered in the session config guide.

See the step-by-step remediation: how to fix this.