Courses / Frontend Security & Observability
11. Secure cookie usage for session cookies
Using HttpOnly, Secure, SameSite attributes appropriately for session cookies in frontends.
JavaScript
Secure cookie usage for session cookies
Attributes like HttpOnly, Secure, and SameSite control where and how browser cookies (especially session cookies) are sent so attackers and cross-site requests can't misuse them.
"I want my session cookie to be used by my site only, not stolen or sent to unknown sites."
Set HttpOnly to stop JavaScript from reading the cookie, Secure to require HTTPS, and SameSite to limit cross-site sending; together they reduce XSS/CSRF risks for session cookies.
"I want my session cookie to be used by my site only, not stolen or sent to unknown sites."
Set HttpOnly to stop JavaScript from reading the cookie, Secure to require HTTPS, and SameSite to limit cross-site sending; together they reduce XSS/CSRF risks for session cookies.