Cookie Security Reference
Reference for cookie attributes: Secure, HttpOnly, SameSite, and prefix conventions.
Security Attributes
The Secure attribute restricts cookies to HTTPS-only transmission. HttpOnly prevents JavaScript access via document.cookie, mitigating XSS theft. SameSite controls cross-site sending: Strict (never), Lax (top-level GET only), None (always, requires Secure). The __Host- prefix requires Secure, Path=/, and no Domain. The __Secure- prefix requires Secure. Max-Age and Expires control lifetime; session cookies expire on browser close.
- Secure
- HTTPS only
- HttpOnly
- No JS access
- SameSite
- Cross-site policy
no HTTP sendXSS mitigationStrict/Lax/NoneSameSite and CSRF
SameSite=Lax is the modern browser default, preventing most CSRF without tokens. SameSite=Strict is most restrictive but breaks cross-site navigation (e.g., clicking a link to your site). SameSite=None+Secure is needed for third-party cookies (iframes, tracking). CSRF tokens remain necessary for same-site attacks and defense in depth. Cookie prefixes (__Host-) prevent cookie shadowing attacks. Partitioned cookies (CHIPS) isolate third-party cookies per top-level site.
- Lax default
- Modern browsers
- None+Secure
- Third-party
- __Host-
- No Domain, Path=/
CSRF mitigationrequires Secureanti-shadowing