Fix · Cloudflare
Fix “Cookie hygiene” on Cloudflare
Set every session cookie with: HttpOnly; Secure; SameSite=Lax
// Set cookie flags at your origin app; Cloudflare will
// pass them through unchanged.Verify the fix
Re-run the Cookie hygiene check after deploying. Test config changes in staging first and keep a rollback: a wrong header can break a site faster than a missing one.
Other stacks: nginx · Apache · Caddy · Express / Node