Skip to content

Security · Next.js (App Router)

Secure, HttpOnly and SameSite cookie flags explained in Next.js (App Router)

`HttpOnly` is what stops any script on the page from reading a session cookie — without it, one injected script is a full account takeover. `Secure` stops it being sent over plain HTTP, and `SameSite` is the main defence against cross-site request forgery.

The fix for Next.js (App Router)

13x detects your framework from the response and hands you this version rather than the generic one — below 50% confidence it hedges and gives you the generic one instead.

ts code
import { cookies } from "next/headers";

const store = await cookies();
store.set("session", token, {
  httpOnly: true,
  secure: process.env.NODE_ENV === "production",
  sameSite: "lax",
  path: "/",
  maxAge: 60 * 60 * 24 * 7,
});

secure is gated on the environment because localhost is not HTTPS and the cookie would otherwise be dropped in development.

On a different stack? The general version of this fix explains what 13x checks and why it matters, without assuming a framework.

Check your Next.js (App Router) site

113 deterministic checks against your live URL, in about 30 seconds. Framework detected from the response, so every fix comes back in the form your stack actually uses.

No signup. Results in 30 seconds.