Cookies over HTTP
Lock down a session cookie
Create a host-bound session cookie that resists script reads, insecure transport, and unnecessary cross-site delivery.
8 minute lesson
A session cookie carries authority. Give it the narrowest useful access.
Set authentication cookies on the server. Use Secure, HttpOnly, an appropriate SameSite value, a controlled lifetime, and no broad Domain. The __Host- prefix adds browser-enforced rules: Secure, Path=/, and no Domain.
Set-Cookie: __Host-session=opaque-random-id; Path=/; Max-Age=1800; Secure; HttpOnly; SameSite=LaxHttpOnly prevents document.cookie from reading the value. It does not stop injected JavaScript from performing authenticated actions. Prevent XSS and protect state-changing cookie requests from CSRF too.
Keep account data and authorization on the server. The cookie should contain an opaque identifier, not a trusted role, email address, or password.
Rotate the identifier after login and privilege changes. Revoke its server record on logout instead of waiting for browser expiration.
Inspect a session cookie from an application you control. Justify its name prefix, transport, script access, same-site behavior, scope, lifetime, rotation, and server-side revocation.
Lesson completed