How to fix insecure cookie on BigCommerce

Steps for BigCommerce

1. BigCommerce manages core session cookies (SHOP_SESSION_TOKEN, etc.) at the platform level — contact BigCommerce support if the scanner flags their own cookies, as these are set server-side by the platform.
2. For cookies set by your custom Stencil theme JavaScript, move cookie creation to a server-side API route (BigCommerce App or serverless function) and set flags there.
3. For a custom BigCommerce headless/Next.js storefront, set cookies in your API routes using response.setHeader('Set-Cookie', 'name=value; HttpOnly; Secure; SameSite=Strict').
4. Navigate to BigCommerce Admin → Storefront → Script Manager and review any third-party scripts that might set cookies; contact those vendors to enable secure flags.
5. Verify in browser DevTools → Application → Cookies.

What is insecure cookie?

Every cookie your store sets can carry optional security flags that tell the browser how to protect it. The three most important are: *HttpOnly* (JavaScript on the page cannot read the cookie — so a malicious script injected into your site cannot steal it), *Secure* (the cookie is only ever sent over HTTPS, never plain HTTP), and *SameSite* (the cookie is not sent along with cross-site requests, blocking a class of attack called Cross-Site Request Forgery, or CSRF). A cookie missing any of these flags is being sent to your customers' browsers without those protections in place.

Without HttpOnly, a single piece of injected JavaScript — from a compromised ad, a third-party widget, or an XSS vulnerability anywhere on your site — can silently read your customers' session cookies and hand them to an attacker, who then logs in as that customer and takes over their account. Without Secure, the cookie can leak over unencrypted connections. Without SameSite, attackers can craft malicious pages that silently submit requests to your store as a logged-in customer (CSRF). Together, insecure cookies are one of the most common ways ecommerce accounts get hijacked, leading to fraudulent orders, leaked personal data, and regulatory liability under laws like GDPR and PCI-DSS. OWASP ranks this entire class of flaws as A07:2021 — Identification and Authentication Failures.

See the complete Insecure cookie guide for every platform and the full background.