Cookie Security Flags (HttpOnly, Secure, SameSite)

HttpOnly prevents ordinary JavaScript from reading a cookie through document.cookie, helping reduce some risks from script injection. Secure tells compliant browsers to send the cookie only over HTTPS, with limited local-development exceptions. SameSite controls circumstances in which cookies accompany cross-site requests; values include Strict, Lax and None. These attributes address different problems and should be chosen together.

Session cookies typically benefit from appropriate HttpOnly and Secure settings, and a carefully selected SameSite policy. Some legitimate cross-site authentication or embedded-service flows need additional consideration. Modern browsers require Secure with SameSite=None. Cookie flags do not replace robust session handling, CSRF defenses or protection against malicious scripts.

These settings are not the same as a cookie consent banner or a privacy-law determination. They are technical controls in the Set-Cookie response header. A site should test login, embedded widgets and browser behavior after changes rather than enabling a flag without considering how authentication and navigation work.