Secure Cookies

---

Cookies are a text file used to store information about a user when they visit a website.

• uses:
  • maintain session states
  • remember user preferences
  • and track user behavior and other settings
• can be exploited if not properly secured
  • lead to attacks such as session hijacking or cross-site scripting
• To implement secure cookies, developers must follow certain well-documented principles:
  • using the ‘Secure’ attribute for all cookies
    • to ensure they are only sent over HTTPS connections
  • using the ‘HttpOnly’ attribute
    • to prevent client-side scripts from accessing cookies
    • and protect against cross-site scripting attacks
  • using the ‘SameSite’ attribute
    • to limit when cookies are sent to mitigate cross-site request forgery attacks
  • cookies should have expiration time limits to restrict their usable life