The problem
A cookie set without the Secure flag will ride along on an unencrypted HTTP request, which is all an attacker on the same network needs to read a session token straight off the wire. It creeps in quietly, from a misconfigured backend, a third party widget, or a debug toggle that shipped. Every page renders perfectly and every functional test passes, because the flag lives in the cookie metadata, not anywhere a screenshot or a click can reach. The gap surfaces in a security review months later, or worse, in an incident.
The idea
The Secure flag is the cookie promising it will only travel on an encrypted connection. This walks every cookie and makes sure not one of them forgot to say it.
What you will catch
- A session or auth cookie set without the Secure flag
- A third party cookie that quietly weakens your security posture
- A finding a penetration test would flag, caught before it ships
How it works
Kane CLI reads each cookie's attributes at the protocol level rather than from document.cookie, so it inspects the Secure flag on every cookie, including the HttpOnly ones a page script can never see. You assert in plain English that none of them are missing it.
Run it now
kane-cli --tui
# then paste this objective:
Go to https://github.com and let it load.
Assert: no cookie is set without the Secure flag.Or one line, for CI or sharing
kane-cli run "Go to https://github.com and let it load.
Assert: no cookie is set without the Secure flag." --agentWhat prints
Example run. Your numbers will vary by site, build and run. The PASS / FAIL and the zeros are the stable result, the raw timings and counts are illustrative.
▶ navigate + read cookies ok ▶ assert no cookie without Secure 0 found ✓ PASS RESULT PASS exit 0 ~50s ~7 to 13 credits
Adapt it to your app
Go to <your app> and complete <a flow that sets your cookies>.
Assert: no cookie is set without the Secure flag.Why it works
The check reads cookie attributes from the protocol layer, so it sees the Secure flag on every cookie the site sets, not just the ones JavaScript can read. A single cookie missing Secure is one downgrade away from leaking, which is exactly the gap this closes.
What it unlocks
A one line security gate. Wire it into CI and a cookie that ships without Secure fails the build, instead of waiting to be found in a penetration test.
