菜单
Assess and harden HTTP cookie flags: Secure, HttpOnly, SameSite, Domain, Path, Prefixes (__Host-/__Secure-), and Max-Age/Expires. Use when reviewing session or auth cookies for missing flags, overly broad scope, CSRF exposure, or XSS cookie theft risk on authorized applications.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/tomysh1337/openstarry-code --skill cookie-security-flags命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
Frontend accessibility (a11y) testing checklist at WCAG high level: semantic HTML, keyboard, focus, names/roles, contrast, forms, media, and ARIA discipline. Use when accessibility, a11y, 无障碍, WCAG, screen reader, keyboard navigation, ARIA, focus trap, color contrast, or accessible UI review. Complements code-quality-standards; does not replace product design systems or legal audits.
Design account lockout and progressive auth-failure controls: attempt counters, lock duration, dual keys (account + IP), unlock paths, enumeration-safe UX, and lockout vs soft rate limits. Use when login lockout policy, failed-attempt thresholds, temporary ban after N passwords, progressive delay, or lockout vs rate-limit design for owned applications.
Authorized account-takeover (ATO) methodology that chains password-reset, session fixation, IDOR/BOLA, JWT/API tokens, and OAuth/OIDC failures into end-to-end impact paths. Use when planning or executing multi-vector ATO assessment with owned test accounts only — not single-class deep dives alone.
| name | cookie-security-flags |
| description | Assess and harden HTTP cookie flags: Secure, HttpOnly, SameSite, Domain, Path, Prefixes (__Host-/__Secure-), and Max-Age/Expires. Use when reviewing session or auth cookies for missing flags, overly broad scope, CSRF exposure, or XSS cookie theft risk on authorized applications. |
Set-Cookie audit.HttpOnly), cleartext/MITM (no Secure), cross-site CSRF (SameSite=None/absent), or subdomain fixation (broad Domain=).session-fixation-management or csrf-cross-site-request-forgery when the root issue is flag/scope misconfiguration.code-quality-standards.Set-Cookie flags → storage scope (Domain/Path/Secure/lifetime)
→ attachment (SameSite × request kind) → script access (HttpOnly)
| Attribute | Intent | Typical failure |
|---|---|---|
| Secure | HTTPS-only | Theft on HTTP / mixed content |
| HttpOnly | Block document.cookie | XSS → session theft |
| SameSite | Cross-site attach policy | CSRF if None/absent + weak token |
| Domain | Host scope | Sibling subdomain set/read |
| Path | Path scope | Attach on sibling apps |
| Max-Age/Expires | Lifetime | Long-lived stolen sessions |
| __Host- | Secure + Path=/ + no Domain | Tight host binding |
| __Secure- | Requires Secure | Weaker than __Host- |
Good proof: Cookie attaches or is script-readable under a condition the flag should block.
Bad proof: Flag laundry list with no browser scenario or related control considered.
Inventory cookies at login, refresh, logout, SSO callback:
| Field | Capture |
|---|---|
| Name / purpose | session, refresh, CSRF, preference |
| Secure / HttpOnly | yes/no |
| SameSite | Strict / Lax / None / absent |
| Domain / Path | host-only vs .parent; / vs prefix |
| Lifetime / prefix | session vs Max-Age; __Host- / __Secure- |
Set-Cookie: session=REDACTED; Path=/; HttpOnly; Secure; SameSite=Lax
Set-Cookie: csrf=REDACTED; Path=/; Secure; SameSite=Strict
Note cookies set on subdomains, CDN hosts, or OAuth redirects separately.
Browser defaults — Missing SameSite defaults toward Lax on modern Chrome; other engines differ. Record test browser. SameSite=None without Secure is dropped in modern browsers — confirm jar contents, not headers alone.
Secure — Auth cookies without Secure on HTTPS sites are cleartext/MITM risks. If HTTP remains in scope, verify the cookie is sent on http://. HSTS does not replace Secure on first visit.
HttpOnly — Session without HttpOnly: on authorized same-origin script context, confirm name appears in document.cookie (value redacted). CSRF cookies may omit HttpOnly intentionally if JS double-submit is designed (csrf-cross-site-request-forgery). HttpOnly does not stop network attachment or URL SID fixation (session-fixation-management).
SameSite matrix
| Value | Cross-site behavior | Test focus |
|---|---|---|
| Strict | Not sent cross-site | On-site gadgets (open redirect, XSS) |
| Lax | Top-level GET yes; cross-site POST no | State-changing GET / method override |
| Need | Skill |
|---|---|
| CSRF exploitation / token bypass | csrf-cross-site-request-forgery |
| Pre-auth SID accepted after login | session-fixation-management |
| Redirect gadgets / token leak | open-redirect, open-redirect-advanced |
| OAuth callback session binding | oauth-oidc-misconfiguration |
| XSS reading non-HttpOnly cookies | xss-cross-site-scripting |
| Implement cookie options / middleware | code-quality-standards |
Set-Cookie profile + regenerate-on-login reminderCookie headers — do not trust docs alone.SameSite=None without a CSRF design is a finding.__Host- for new session cookies when compatible.| None; Secure |
| Sent including POST |
| Token defenses must hold |
| Absent | Browser-dependent | Victim browser profile |
<script>location = "https://target.example/account";</script>
<form action="https://target.example/email/change" method="POST">
<input name="email" value="attacker@test.example">
</form>
<script>document.forms[0].submit();</script>
In proxy, check whether Cookie: included the session. Full CSRF methodology → csrf-cross-site-request-forgery.
Domain and Path — Prefer host-only (omit Domain) for sessions. Domain=.example.com exposes sibling hosts; weaker sibling XSS/set-cookie enables fixation or theft depending on HttpOnly. Over-broad Path=/ may attach admin sessions to less trusted apps — note boundaries; test siblings only if in scope.
Prefixes — __Host-name=...; Secure; Path=/ without Domain is strongest common pattern (browsers reject bad __Host- combos). __Secure- only requires Secure. Recommend prefixes for new session cookies.
Lifetime and logout — Long Max-Age widens theft window; remember-me should be a separate revocable token. Logout clear must match Domain/Path/Secure/SameSite. Flags alone do not fix missing regenerate-on-login → session-fixation-management.
Chains — Open redirect + Lax session as GET CSRF gadget → open-redirect / open-redirect-advanced. OAuth callback briefly setting SameSite=None — retest after login settles. Weak double-submit CSRF cookie → CSRF skill.
Remediation (with code-quality-standards)
Set-Cookie: __Host-session=<id>; Path=/; Secure; HttpOnly; SameSite=Lax
# CSRF double-submit: Secure; SameSite=Strict; omit HttpOnly only if JS must read
# Avoid parent Domain= unless required; document sibling risk
Check framework knobs: Express cookie/session; ASP.NET CookieSecurePolicy/SameSite; Spring CookieSerializer; Django SESSION_COOKIE_*; Rails same_site.