Cookie sessions and secure cookie attributes

HttpOnly, Secure and SameSite: three attributes against three different attacks.

UnderstandStudy an examplePractise

Understand the concept

When session information travels in a cookie, the browser adds it automatically to every request to that site. That convenience must be protected with the right attributes. HttpOnly prevents JavaScript from reading the cookie; even if a page has an XSS hole, the session cookie cannot be stolen through document.cookie. Secure ensures the cookie is only sent over HTTPS.

SameSite decides whether the cookie is attached to requests initiated by another site. Strict sends it only for same-site requests; Lax allows top-level navigations (clicking a link) but not POST requests from another site. This is an important layer against CSRF attacks.

This project’s admin panel uses the same approach: the token produced by the API is never given to browser JavaScript; Next.js writes it into an HttpOnly, Secure, SameSite=Strict cookie. The simulator’s ‘Sign in’ scenario shows the flow step by step.

WHEN TO USE IT

The session cookie is the user’s identity; stealing it means taking over the account.

COMMON PITFALL

Storing tokens in localStorage, where any XSS on the page can read them.

LIVE ANIMATION

A letter’s journey through the city

Think of a request as a letter and the server as a city. Pick a scenario, press play and watch which gates the letter passes and where it gets stopped.

OUTBOUND →

You sent the sign-in form. Your password travels inside the encrypted tunnel, never in the address bar.

BrowserYour screen. It writes the request and finally turns the answer into a page.

1 / 12

01 / PRACTICE

One topic. Three levels of depth.

Illustrative example

Set-Cookie: admin_session=eyJ…; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=1800

Three security attributes and a short-lived session.

This page connects to no real server or database. Code samples are illustrative for .NET 8, Next.js and SQL Server; timings are example values in the simulation, not measurements. Try samples only in your own development environment; never share real connection strings, tokens or passwords.

02 / YOUR TURN

Try it yourself first.

An SPA keeps its JWT in localStorage and adds it to every request in the Authorization header. A third-party comment widget is added to the page. What is the risk and how do you reduce it?

Show the solution and explanation

Worked solution

Eklentideki veya sayfadaki herhangi bir XSS, localStorage’daki token’ı okuyup dışarı gönderebilir.
Azaltma: token’ı HttpOnly + Secure + SameSite çerezde tutmak (BFF deseni),
kısa ömür, sıkı Content-Security-Policy ve çıktı kodlama.

Any storage JavaScript can reach is storage any code on the same page can reach.

RasimAtaberkŞahin

Understand the concept

One topic. Three levels of depth.

Try it yourself first.