Security configurations for cookies (HttpOnly, Secure, SameSite)

HttpOnly Attribute

HttpOnly is an important security attribute for cookies, used to prevent Cross-Site Scripting (XSS) attacks from stealing cookies. When HttpOnly is set to true, JavaScript cannot access the cookie via document.cookie; it can only be automatically sent by the browser in HTTP requests.

// Example of setting an HttpOnly cookie (Node.js Express)  
res.cookie('sessionID', 'abc123', {  
  httpOnly: true,  
  maxAge: 24 * 60 * 60 * 1000 // 1-day expiration  
});  

Practical use cases:

1. Session identifiers (Session IDs) must have HttpOnly set.
2. Authentication tokens should enable this attribute.
3. Cookies storing sensitive data require this protection.

Testing methods:

• Enter document.cookie in the browser console—HttpOnly cookies will not appear.
• Use the Application panel in developer tools to view all cookies and their attributes.

Secure Attribute

The Secure attribute ensures cookies are only transmitted over HTTPS encrypted connections, preventing man-in-the-middle attacks from stealing plaintext cookies. On HTTP sites, browsers will refuse to send cookies with the Secure attribute.

// Setting both Secure and HttpOnly  
res.cookie('userToken', 'xyz789', {  
  secure: true,  
  httpOnly: true,  
  sameSite: 'strict'  
});  

Deployment considerations:

1. HTTPS must be enabled in production environments.
2. In development environments, Secure may need to be disabled for testing purposes.
3. Mixed content (HTTPS pages loading HTTP resources) may cause Secure cookies to fail.

Common issue resolutions:

• Chrome's special handling of localhost during local development.
• Protocol mismatches caused by proxy servers.
• Secure cookies being rejected due to invalid certificates.

SameSite Attribute

SameSite controls cross-site cookie-sending behavior and is a critical mechanism for defending against CSRF attacks. It has three possible values:

• Strict: Completely prohibits sending in third-party contexts.
• Lax: Allows sending with certain safe requests (e.g., navigation redirects).
• None: Allows cross-site sending (must also set Secure).

// Examples of different SameSite policies  
res.cookie('preferences', 'dark_mode', {  
  sameSite: 'lax',  
  httpOnly: false // Allows frontend JavaScript access  
});  

res.cookie('csrfToken', 'qwerty', {  
  sameSite: 'strict',  
  httpOnly: true  
});  

Browser compatibility handling:

• Chrome 80+ treats cookies without SameSite as Lax by default.
• For older browser support, explicitly set SameSite=None; Secure.
• Known implementation differences exist in systems like iOS 12.

Combined Security Policies

Best practices involve combining all three attributes:

// High-security cookie configuration  
res.cookie('auth', 'jwt_token', {  
  httpOnly: true,  
  secure: true,  
  sameSite: 'strict',  
  path: '/api',  
  domain: 'example.com',  
  maxAge: 3600000  
});  

Special scenario handling:

1. Cross-domain Single Sign-On (SSO) requires SameSite=None.
2. Business scenarios with embedded iframes must consider cookie access policies.
3. Mobile WebViews may require additional configuration.

Real-World Deployment Example

E-commerce website cookie configuration example:

// User session cookie  
res.cookie('session', encryptedSession, {  
  httpOnly: true,  
  secure: true,  
  sameSite: 'lax',  
  path: '/'  
});  

// CSRF protection token  
res.cookie('XSRF-TOKEN', randomToken, {  
  secure: true,  
  sameSite: 'strict',  
  path: '/checkout'  
});  

// Cookie required for third-party payment callbacks  
res.cookie('payment_callback', callbackId, {  
  secure: true,  
  sameSite: 'none',  
  httpOnly: true  
});  

Debugging tips:

1. Use Chrome's Application panel to check actual cookie attributes.
2. Inspect Set-Cookie response headers with curl -I.
3. Verify cookie transmission via network packet capture.

Cookie Security and Privacy Regulations

Requirements under GDPR and CCPA:

1. Users must be clearly informed about cookie purposes.
2. Non-essential cookies require user consent.
3. Provide cookie management options.

Compliant configuration example:

// Set analytics cookies only with user consent  
if (userConsent.analytics) {  
  res.cookie('_ga', trackingId, {  
    sameSite: 'lax',  
    secure: true,  
    maxAge: 63072000 // 2 years  
  });  
}  

Common Vulnerability Patterns

1. Sensitive cookies without HttpOnly enabling XSS theft:

// Bad example: Authentication cookie accessible via JavaScript  
res.cookie('auth_token', token, { httpOnly: false });  

2. Improper SameSite configuration leading to CSRF:

// Dangerous: Allows cross-site sending without Secure  
res.cookie('user_prefs', prefs, { sameSite: 'none' });  

3. Excessively long expiration times increasing risk:

// Not recommended: Session cookie with overly long expiration  
res.cookie('session', sessionId, {  
  maxAge: 365 * 24 * 60 * 60 * 1000 // 1 year  
});  

Server-Side Configuration Examples

Nginx secure cookie setup:

location / {  
  add_header Set-Cookie "sessionid=12345; Path=/; HttpOnly; Secure; SameSite=Lax";  
  proxy_pass http://backend;  
}  

Apache configuration example:

Header always edit Set-Cookie ^(.*)$ "$1; HttpOnly; Secure; SameSite=Strict"  

Client-Side Detection Methods

JavaScript cookie security check:

function checkCookieSecurity(name) {  
  const cookies = document.cookie.split(';');  
  const target = cookies.find(c => c.trim().startsWith(`${name}=`));  

  if (!target) return 'Not Found';  

  const secure = /;\s*Secure/i.test(target);  
  const httpOnly = !document.cookie.includes(name);  
  const sameSite = target.match(/;\s*SameSite=(\w+)/i);  

  return {  
    secure,  
    httpOnly,  
    sameSite: sameSite ? sameSite[1] : 'Not Set'  
  };  
}  

Browser Compatibility Matrix