Question 1

What does the HttpOnly cookie attribute do?

Accepted Answer

HttpOnly tells the browser not to expose the cookie to client-side JavaScript through document.cookie. This is a key defense against cross-site scripting (XSS): even if an attacker injects a script, it cannot read an HttpOnly session cookie and exfiltrate it. Session and authentication cookies should always be HttpOnly.

Question 2

Why does SameSite=None require the Secure attribute?

Accepted Answer

SameSite=None means the cookie is sent on cross-site requests, which is the exact scenario CSRF attacks exploit. To reduce the risk, browsers (Chrome 80+ and others) reject a SameSite=None cookie unless it also has the Secure flag, guaranteeing it is only ever transmitted over HTTPS. A SameSite=None cookie without Secure is silently dropped.

Question 3

What is the difference between Expires and Max-Age?

Accepted Answer

Both control how long a cookie persists. Expires takes an absolute date (in GMT), while Max-Age takes a number of seconds relative to when the cookie is received. When both are present, Max-Age takes precedence in modern browsers. If neither is set, the cookie is a session cookie and is deleted when the browser closes.

Cookie Inspector

Hardening Session Cookies

Frequently Asked Questions