Ravi Sir's Cyber Security Cards › Interview Cards
What headers or cookie flags do you mention for session security?
What headers or cookie flags do you mention for session security? HttpOnly and Secure on session cookies, SameSite where it fits, and HTTPS everywhere. HttpOnly means JavaScript can’t read the cookie, so an XSS bug can’t steal the session. “HttpOnly, Secure, SameSite and HTTPS together cut session t
Read card text
What this card says
Short answer
HttpOnly and Secure on session cookies, SameSite where it fits, and HTTPS everywhere.
Example
HttpOnly means JavaScript can’t read the cookie, so an XSS bug can’t steal the session.
Say it in the interview
“HttpOnly, Secure, SameSite and HTTPS together cut session theft a lot.”
Why it matters
A cookie readable by JavaScript or sent over HTTP is easy to steal.
Learn more in the lesson: 46.4 Web Servers and MySQL Interview Questions