Question 1

What does each cookie flag actually do?

Accepted Answer

HttpOnly blocks JavaScript from reading the cookie via document.cookie, which stops XSS from stealing it. Secure means the cookie is only sent over HTTPS. SameSite controls whether the cookie is attached on cross-site requests: Strict never sends it cross-site, Lax sends it only on top-level navigations, and None sends it always (but requires Secure).

Question 2

Why can't every cookie just use HttpOnly?

Accepted Answer

HttpOnly is right for secrets the server owns (session IDs, auth tokens), but it breaks patterns where the browser must read the value — for example a double-submit CSRF token that JavaScript echoes into a request header. The correct flags depend on who needs to read the cookie and where it must travel.

Question 3

Why does SameSite=None require Secure?

Accepted Answer

A None cookie is sent on every cross-site request, which is exactly the exposure that makes it valuable to attackers if intercepted. Modern browsers therefore reject SameSite=None unless the Secure flag is also set, guaranteeing the cookie only ever leaves over HTTPS.

Cookie Flags

How to play

Frequently Asked Questions