Cookie Security Flags: Auditing Secure, HttpOnly, SameSite

Most session hijacking bugs I find in audits are not exotic. They are a session cookie missing one attribute: HttpOnly left off so an XSS payload can read it, Secure missing so it rides over a plain H