Which flags should be set on session cookies?

Question

Accepted Answer

HttpOnly, Secure, and SameSite — blocking scripts, forcing HTTPS, and mitigating CSRF — These three flags block script access to reduce XSS theft, force HTTPS, and mitigate CSRF — Domain, Path, and Max-Age only scope reach and lifetime, Priority, Partitioned, and Size tune storage, and Public, Private, and no-store are Cache-Control directives rather than cookie security flags.

Answer

Domain, Path, and Max-Age — scoping the cookie's reach and controlling its lifetime

Answer

Priority, Partitioned, and Size — tuning how the browser stores the cookie on disk

Answer

Public, Private, and no-store — the cache-control directives applied to the cookie

Which flags should be set on session cookies?

Why this is the answer

More Secure Coding flashcards