flags

Overview

Cookie flags (attributes) are the settings that make a session cookie safe — controlling whether scripts can read it, whether it travels only over HTTPS, and whether it is sent on cross-site requests. Setting them correctly is essential session hardening. This lesson covers cookie flags.

Learning objectives

• Identify the key security cookie flags.
• Explain what each flag protects against.
• Apply appropriate flags to session cookies.

Core concept

The security-relevant cookie attributes:

• HttpOnly — the cookie cannot be read by JavaScript, mitigating theft via XSS.
• Secure — the cookie is only sent over HTTPS, preventing interception over plain HTTP.
• SameSite (Strict/Lax/None) — controls whether the cookie is sent on cross-site requests, mitigating CSRF.
• Scope/lifetime attributes: Domain, Path, and Expires/Max-Age.

For a session cookie, the strong baseline is HttpOnly; Secure; SameSite=Lax (or Strict).

How it works

Each flag closes a specific avenue: HttpOnly stops malicious script from reading the cookie value (so even an XSS flaw cannot directly steal the session cookie); Secure ensures the cookie is never sent in cleartext where it could be intercepted; SameSite limits sending the cookie on requests originating from other sites, blunting CSRF. Together they layer protections so that a single weakness elsewhere is less likely to lead to session compromise. The scope/lifetime attributes limit where and how long the cookie is valid.

Practical example

A well-configured session cookie: Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/. HttpOnly means an XSS payload cannot read document.cookie to steal the session; Secure means it will not leak over HTTP; SameSite=Lax means it is not sent on most cross-site requests, reducing CSRF exposure. Omitting these flags is a common, high-impact finding — an XSS could then directly exfiltrate the session cookie.

Cybersecurity relevance

Cookie flags are among the most frequently assessed session controls. Missing HttpOnly turns any XSS into potential session theft; missing Secure risks interception; missing/incorrect SameSite widens CSRF exposure. Setting the correct flags is cheap and high-value hardening. Testers routinely check session cookie flags; defenders should apply HttpOnly; Secure; SameSite by default and scope cookies tightly.

Common mistakes

• Omitting HttpOnly, allowing script to read (and steal) session cookies.
• Omitting Secure, permitting the cookie to be sent over plain HTTP.
• Not setting SameSite, leaving broader CSRF exposure; or over-scoping Domain/Path.

Key takeaways

• Key flags: HttpOnly (blocks script access — anti-XSS-theft), Secure (HTTPS-only), SameSite (limits cross-site sending — anti-CSRF), plus Domain/Path/Expires for scope and lifetime.
• Session cookies should default to HttpOnly; Secure; SameSite=Lax/Strict.
• Missing cookie flags are common, high-impact findings; correct flags are cheap, essential session hardening.

Check your understanding

• What attack does the HttpOnly flag mitigate, and how?
• What is the purpose of the SameSite attribute on a session cookie?