3 ms·
Agree but be sure to configure the cookie correctly. Set it to http-only, "secure" (only transmit over https) and set the domain/path correctly so only your se
by foreigner 9y ago
Agree but be sure to configure the cookie correctly. Set it to http-only, "secure" (only transmit over https) and set the domain/path correctly so only your server/application can see it.
- ademarre 9y agoUse the "__Host-" name prefix. [0] This prevents cookies from being set at the root domain by a subdomain. Which in turn prevents non-TLS MITM cookie injection [1] as long as the application uses HSTS (even without includeSubdomains from the root). [0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se... [1] https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/zheng https://www.usenix.org/conference/usenixsecurity15/technical...