One rule
Treat an auth cookie like a house key. Send it only where needed, hide it from browser JavaScript, and give it an expiry.
The safest default for most college projects is an HttpOnly, Secure cookie with SameSite=Lax and a sensible maxAge.
What flags do
HttpOnly means JavaScript cannot read the cookie using document.cookie. This reduces damage if one page gets an XSS bug.
Secure means the browser sends the cookie only over HTTPS. SameSite controls when the browser sends the cookie during cross-site requests.
Set safe defaults
Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.
0 of 5 done
Express example
This example sets a session cookie after your login check has already passed. The value should be a random session id or a signed token created by your server.
In local development, Secure cookies may not work on plain http://localhost. Use an environment check, then make sure production uses HTTPS.
app.post('/login', async (req, res) => {
// 1. Verify email and password first.
// 2. Create a server-side session or signed token.
const sessionId = await createSessionForUser(user.id);
res.cookie('sid', sessionId, {
httpOnly: true,
secure: process.env.NODE_ENV === 'production',
sameSite: 'lax',
maxAge: 1000 * 60 * 60 * 24 * 7,
path: '/'
});
res.json({ ok: true });
});
app.post('/logout', (req, res) => {
res.clearCookie('sid', {
httpOnly: true,
secure: process.env.NODE_ENV === 'production',
sameSite: 'lax',
path: '/'
});
res.json({ ok: true });
});Common mistake
Do not store access tokens in localStorage because it is easy for JavaScript on the page to read them. If an attacker gets script execution, localStorage is a simple target.
Also do not put user roles, email, or secrets in a cookie and trust them directly. A cookie is sent by the browser, but your server must still verify it.
Check in DevTools
After sign-in, open your browser DevTools and inspect Application or Storage, then Cookies. You should see the cookie name, expiry, HttpOnly, Secure, and SameSite values.
For your README, add a small section called Auth cookie choices. Mention the flags you used and how you tested logout removes the cookie.
CSRF note
Cookies are sent automatically by the browser. That is useful, but it can create CSRF risk on state-changing routes like payment, profile update, or delete account.
SameSite=Lax helps for many normal cases. If you use SameSite=None for cross-site needs, you must use Secure and add a CSRF protection plan.
Do this now
Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.
0 of 5 done