Fix Insecure Cookie Attributes in Vibe-Coded Apps

Quick answer

Insecure cookie attributes — missing HttpOnly, Secure, SameSite, or improper Path — are a top vulnerability in AI-coded apps. Fix them by explicitly setting these flags on every cookie your app creates, especially session and authentication tokens. Use your framework's built-in cookie options or a middleware to enforce secure defaults.

Why cookies matter in vibe-coded apps

When you build an app with AI tools like Cursor, Bolt.new, or v0, the generated code often handles cookies implicitly — through frameworks like Next.js or Express. The AI might skip security flags, leaving your cookies accessible to JavaScript (XSS), sent over HTTP, or vulnerable to CSRF. For indie makers shipping fast, this is an easy miss with serious consequences.

What to check first

Before diving into fixes, audit your app for common cookie misconfigurations:

Use OverMCP's security headers checker to scan your deployed app for missing cookie flags.

Step-by-step fix

1. Set cookie attributes server-side

In most frameworks, you can set cookie options when creating a response. Here's an example in Next.js (App Router) using the cookies() API:

import { cookies } from 'next/headers';

export async function POST(request: Request) {
  // ... authenticate user
  const cookieStore = cookies();
  cookieStore.set('session_token', token, {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'lax',
    path: '/',
    maxAge: 60 * 60 * 24 * 7, // 7 days
  });
  return new Response('Logged in');
}

For Express (common in Bolt.new apps):

res.cookie('session_token', token, {
  httpOnly: true,
  secure: true,
  sameSite: 'strict',
  maxAge: 7 * 24 * 60 * 60 * 1000,
});

2. Enforce with middleware

Create a middleware to ensure all cookies set by your app have secure defaults. Example for Next.js:

// middleware.ts
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

export function middleware(request: NextRequest) {
  const response = NextResponse.next();
  // Optionally rewrite Set-Cookie headers
  return response;
}

export const config = {
  matcher: '/api/:path*',
};

3. Use `__Host-` prefix for sensitive cookies

This prefix ensures the cookie is only set from a secure origin and has a path of /. It prevents subdomain attacks.

res.cookie('__Host-session', token, {
  httpOnly: true,
  secure: true,
  sameSite: 'strict',
  path: '/',
});

4. Test your configuration

Use browser DevTools (Application > Cookies) to inspect cookie flags. Also try accessing your app over HTTP and check if cookies are sent.

Common mistakes

How OverMCP helps

OverMCP's free AI app security scanner can detect missing cookie flags in your vibe-coded app. It scans your deployed endpoints and reports misconfigurations like HttpOnly missing or SameSite not set. For continuous protection, set up continuous security monitoring to catch regressions after every deploy.

FAQ

How do I check if my cookies are secure?

Open browser DevTools > Application > Cookies. Click a cookie and inspect the flags: HttpOnly, Secure, SameSite. Also use OverMCP's security headers checker to scan your site for missing cookie attributes.

What does HttpOnly do?

HttpOnly prevents client-side JavaScript from accessing the cookie. This mitigates XSS attacks where an attacker steals session tokens via document.cookie.

Should I use SameSite Lax or Strict?

Use Lax for most apps — it allows cookies on top-level navigations (e.g., clicking a link) but blocks them on embedded requests. Use Strict for highly sensitive actions (e.g., payment endpoints) but be aware it may break some user flows.