How to fix insecure cookie on Adobe Commerce (Magento)

Steps for Adobe Commerce (Magento)

1. Log in to the Magento Admin Panel.
2. Go to Stores → Configuration → General → Web → Session Validation Settings and enable 'Use HTTP Only' = Yes.
3. Go to Stores → Configuration → General → Web → Default Cookie Settings: set 'Cookie HttpOnly' = Yes, 'Cookie Secure' = Yes (requires HTTPS), 'Cookie SameSite' = Strict.
4. For session cookies, also check app/etc/env.php or app/etc/config.php for session configuration and set 'cookie_httponly' => 1, 'cookie_secure' => 1, 'cookie_samesite' => 'Strict'.
5. Run bin/magento cache:flush after making config changes.
6. Verify with browser DevTools → Application → Cookies that frontend and adminhtml cookies show all three flags.

What is insecure cookie?

Every cookie your store sets can carry optional security flags that tell the browser how to protect it. The three most important are: *HttpOnly* (JavaScript on the page cannot read the cookie — so a malicious script injected into your site cannot steal it), *Secure* (the cookie is only ever sent over HTTPS, never plain HTTP), and *SameSite* (the cookie is not sent along with cross-site requests, blocking a class of attack called Cross-Site Request Forgery, or CSRF). A cookie missing any of these flags is being sent to your customers' browsers without those protections in place.

Without HttpOnly, a single piece of injected JavaScript — from a compromised ad, a third-party widget, or an XSS vulnerability anywhere on your site — can silently read your customers' session cookies and hand them to an attacker, who then logs in as that customer and takes over their account. Without Secure, the cookie can leak over unencrypted connections. Without SameSite, attackers can craft malicious pages that silently submit requests to your store as a logged-in customer (CSRF). Together, insecure cookies are one of the most common ways ecommerce accounts get hijacked, leading to fraudulent orders, leaked personal data, and regulatory liability under laws like GDPR and PCI-DSS. OWASP ranks this entire class of flaws as A07:2021 — Identification and Authentication Failures.

See the complete Insecure cookie guide for every platform and the full background.