Cookies
SameSite cookies and CSRF: what None, Lax and Strict really do
SameSite is one word on your cookie that decides whether the browser sends it on requests coming from other sites. Get it wrong and you open the door to CSRF.
Tag
#cookies
Cookies
HttpOnly cookies: keeping session tokens away from XSS
If an attacker can run script on your page, the first thing they reach for is your session cookie. One cookie flag — HttpOnly — takes that prize off the table.
Cookies
Cookie security in 5 minutes: Secure, HttpOnly, SameSite
A session cookie is the key to a logged-in account. Three small flags decide whether that key is protected or up for grabs. Here is the five-minute version.