Cookies

Cookies are automatically attached to matching requests based on domain, path, expiration, security attributes, and same-site context. HttpOnly protects tokens from JavaScript reads, Secure requires HTTPS, and SameSite helps control cross-site sending. Cookie design must consider auth, CSRF, subdomains, and privacy changes.

					Set-Cookie: session=...; Path=/; HttpOnly; Secure; SameSite=Lax
				

SameSite=Lax blocks many cross-site POST cookies; Strict is tighter for sensitive sessions. Wide Domain= shares cookies across subdomains — often too broad.

On interviews: compare cookies with bearer tokens in storage and explain why SameSite is not a full CSRF strategy by itself.

Common pitfalls: wide Domain attributes share cookies with too many subdomains. Missing Secure or HttpOnly weakens session protection.

The trade-off is convenience versus control — pick the mechanism that matches your coupling and performance budget.

Checklist:

• HttpOnly session identifiers.
• Secure on production HTTPS.
• Choose SameSite per threat model.
• Scope path and domain minimally.