Secure Defaults for Cookies
Which cookie attributes matter for security (Secure, HttpOnly, SameSite, Domain/Path), and what are sane defaults for a session cookie?
Answers use simple, clear English.
Audio N/AQuick interview answer
Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF reduction), short Path, tight Domain. Prefer __Host- prefix cookies when possible. Avoid long-lived session cookies without rotation.
Detailed answer
Secure (HTTPS only), HttpOnly (no JS access), SameSite=Lax or Strict (CSRF reduction), short Path, tight Domain. Prefer __Host- prefix cookies when possible. Avoid long-lived session cookies without rotation. SameSite=None requires Secure and is needed for some cross-site embeds.
Full explanation
SameSite=None requires Secure and is needed for some cross-site embeds.
Real example & use case
BFF sets session cookie Secure; HttpOnly; SameSite=Lax; Path=/; Max-Age short with sliding refresh.
Pros & cons
Pros: reduces XSS cookie theft and CSRF. Cons: strict SameSite can break legitimate cross-site flows.