← Cookies & Cyber Threats: A Beginner's Guide to Session Security
The Digital Hello: What Are Cookies?
The Memory Problem: Why Websites Need to Remember You The Cookie Solution: What They Are and How They Work Cookies in Action: How Your Browser Uses Them Every Day
The Good, The Bad, and The Cookie: Core Security Features
The Security Trio: HttpOnly, Secure, and SameSite
The Cookie Jar is Breached: How Cybercriminals Abuse Cookies
Common Attack Vectors: How Cookies Are Stolen
Following the Digital Trail: How Cybersecurity Professionals Identify Abuse
Anomaly Detection: Spotting Cookie Abuse
Fortifying the Cookie Jar: Best Practices and Defenses
Defensive Strategies: Protecting Against Cookie Abuse
The Good, The Bad, and The Cookie: Core Security Features

The Security Trio: HttpOnly, Secure, and SameSite

Learn about the three critical security flags that protect cookies from common attacks.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.

In this lesson, you will learn to:

  • Define the purpose and function of the HttpOnly, Secure, and SameSite cookie attributes.

The Security Trio: HttpOnly, Secure, and SameSite

This lesson introduces the HttpOnly, Secure, and SameSite flags. You will learn what each flag does, how it is configured, and which attack it prevents.

Understanding the Security Flags

Cookies have three critical security flags that developers can set to protect them from common attacks. These flags are sent as attributes when the server creates the cookie.

HttpOnly – This flag prevents JavaScript from accessing the cookie. When HttpOnly is set, the cookie can only be sent to the server through HTTP requests. This is crucial because it stops Cross-Site Scripting (XSS) attacks from stealing session cookies through malicious JavaScript code.

Secure – This flag ensures the cookie is only sent over HTTPS connections. If the Secure flag is set, the browser will never transmit the cookie over an unencrypted HTTP connection. This protects against network sniffing and Man-in-the-Middle attacks.

SameSite – This flag controls when the cookie is sent in cross-site requests. It has three values: Strict (only sent for same-site requests), Lax (sent for top-level navigation), and None (sent for all requests, but requires Secure). This flag is designed to prevent Cross-Site Request Forgery (CSRF) attacks by limiting how cookies are sent to other domains.

Cookie Security FlagsA diagram showing the HttpOnly, Secure, and SameSite flags and what they protect against.Cookie Security FlagsThree flags that protect cookies from common attacksHttpOnlyPrevents JavaScript from readingthe cookieProtects against XSSSet-Cookie: session=abc; HttpOnlySecureCookie only sent over HTTPSconnectionsProtects against MitMSet-Cookie: session=abc; SecureSameSiteControls cross-site cookiesending behaviorProtects against CSRFSet-Cookie: session=abc; SameSite=LaxThese flags are essential for secure cookie managementAlways set these flags on production session cookiesThey protect against XSS, Man-in-the-Middle, and CSRF attacksDiagram: Cookie Security Flags
Cookie Security Flags Overview — A diagram showing the three security flags and their protections.
Security Flags in ActionA diagram showing how security flags work together to protect cookies.Security Flags in ActionHow flags prevent specific attacksHttpOnlyStops JavaScript fromreading the cookieBlocks XSS attacksSecureEnsures cookie only sentover HTTPS connectionsBlocks MitM attacksSameSiteControls cross-sitecookie behaviorBlocks CSRF attacksTogether, these flags create a strong defenseUse all three flags on production session cookies for maximum protectionDiagram: Security Flags in Action
Security Flags in Action — A diagram showing how the security flags work together.
← Previous: Cookies in Action: How Your Browser Uses Them Every Day Next: Common Attack Vectors: How Cookies Are Stolen →