Secure Cookies

Cookies are small pieces of data stored on a computer by a web browser while accessing a website.

Cookies maintain session states, remember user preferences, and track user behavior (!) and other settings. They are highly exploitable if not properly secured, leading to session hijacking or cross-site scripting. Developers should mark all their needed cookies with the 'Secure' attribute to force them to use HTTPS. They should use the 'HttpOnly' attribute to prevent client-side scripts from accessing the cookie's data. And they should use the 'SameSite' attribute to protect against XSS forging attempts.