TLS & Web Security•7 min read•intermediate

Securing Cookies: SameSite, Secure, and HttpOnly

Configure robust browser cookie security attributes to protect session credentials from theft and CSRF attacks.

HTTP cookies store sensitive session and authentication tokens. Protecting these tokens requires three critical attributes: Secure ensures cookies are only transmitted over encrypted HTTPS; HttpOnly blocks access from client-side JavaScript (document.cookie); and SameSite controls cross-origin transmission to prevent CSRF.

SameSite Attribute Differences

SameSite=Strict prevents cookie transmission on all cross-site requests, including top-level link navigations. SameSite=Lax (the modern browser default) allows cookies on top-level safe GET navigations while blocking them on cross-site POST requests. SameSite=None permits cross-site transmission, but strictly requires the Secure flag.

Always restrict cookies to specific Path and Domain scopes. Omitting the Domain attribute defaults to host-only scoping, which prevents broader subdomain inheritance.

Applied Engineering

Explore in MemonaIQ Diagnostic Sandbox

Test and inspect these concepts in action using MemonaIQ's browser-based engineering and security tools.

Inspect Cookie Security Attributes

Launch Tool

Preparing your workspace

Connecting MemonaIQ services