Browser security boundaries
Protect session cookies
Use restrictive cookie attributes and understand why a cookie can be sent even when browser JavaScript cannot read it.
8 minute lesson
A session cookie carries authority. HttpOnly keeps it away from scripts, but the browser may still attach it to requests.
Use Secure, HttpOnly, an appropriate SameSite value, a narrow Path, and no unnecessary Domain. Prefer a __Host- prefix when its rules fit. Cookie settings reduce exposure but do not replace server-side session checks or CSRF defenses.
A session cookie is HttpOnly but lacks Secure, so a mistaken HTTP link can expose it before the redirect. Another cookie uses Domain=.flaviocopes.com, giving every subdomain unnecessary scope.
A strict SameSite value can break a legitimate external login return. Choose the narrowest setting that still supports the real flow, then test that flow.
Capture the session Set-Cookie header and justify Secure, HttpOnly, SameSite, Path, Domain, and expiry. Test an HTTP request, a cross-site form, and the real sign-in return path.
Lesson completed