GUIDE深度 · Deep dive
Cookie HttpOnly, Secure and SameSite
HttpOnly hides cookies from JavaScript, reducing session theft via XSS; Secure sends them only over HTTPS; SameSite controls cross-site sending, with Lax a common default.
Three flags
HttpOnly: document.cookie cannot read it.
Secure: HTTPS only.
SameSite=Lax/Strict/None; None requires Secure.
Checks
Session cookies should be HttpOnly+Secure.
Do not set SameSite=None on every cookie.
Audit cookies after login, logout and payment flows, because those paths often set session cookies.
FAQ
Does HttpOnly prevent XSS?
It only blocks cookie reads, not XSS itself.
When to use SameSite=None?
Cross-site embeds/payment callbacks, and it must be Secure.