Original address: https://medium.com/swlh/secure-httponly-samesite-http-cookies-attributes-and-set-cookie-explained-fc3c753dfeb6
Cookies are the most common method to add temporary persistence to websites. They are used in most websites and we know their consent banners. HTTP Cookies can contain crucial and confidential data, their usage started around 1994 and some important legacy issue were left unaddressed and new state-of-art security improvements are being tackled nowadays.
Secure, HttpOnly and SameSite cookies attributes are being addressed by some modern browsers for quite some time and soon they will be enforced.
For example, starting from August 25, 2020, Google Chrome v85 enabled a feature, by default, to reject insecure SameSite=None. New features like this might break your website if you aren’t up-to -date with the latest best practices. Like that example, using the following attributes already are considered best practices and modern browsers will(and should) enforce them soon.
In this article I’m going to explain each one, the reasons why developers should care about them and why a correct implementation of them means extra security for your website.
HttpOnly attribute
HttpOnly attribute focus is to prevent access to cookie values via JavaScript, mitigate against Cross-site scripting (XSS) attacks.
Avoiding XSS may be mitigated just by sanitising user inputs and removing