Skip to content

auth

The cookie and its flags

Three attributes, three different doors.

A session cookie is a bearer token that a browser attaches to requests for you. Everything that makes it convenient is also what makes its attributes matter, and each of the three closes a different door.

HttpOnly stops script on the page from reading it, which is what turns a cross-site scripting defect into a session theft. Secure stops the browser sending it over plain HTTP. SameSite stops it being attached to requests that another site started — which is most of what makes cross-site request forgery work.

  • POST /session

    Look at the Set-Cookie header on each. The bodies are identical.

None of the three are on by default, in any framework worth naming, and this engine does not add them either — a framework that quietly set HttpOnly would be lying about what the handler in front of you does.

So the absence is the defect, the fix is one options object, and the whole exercise is whether you noticed. That is a fair description of most of this track.

This build

shop.example.com

Nothing sent yet. Every request goes to the application in this tab and nowhere else.