configure-secure-cookies

name	configure-secure-cookies
category	web
description	Configure browser cookies with narrow scope, transport protection, script isolation, and deliberate cross-site behavior. Use when a web application stores sessions, state, or preferences in cookies.

configure-secure-cookies

Give each cookie the least reach and lifetime needed for its documented purpose.

Procedure

1. Inventory cookie name, owner, value type, purpose, sensitivity, scope, and lifetime.
2. Set Secure for HTTPS transport and HttpOnly whenever scripts do not need the value.
3. Choose SameSite=Strict, Lax, or None from the actual cross-site flow; pair None with Secure.
4. Narrow Path and omit Domain when a host-only cookie is sufficient.
5. Prefer __Host- or __Secure- prefixes when their constraints match the design.
6. Use session or explicit Max-Age lifetimes and rotate authentication cookies after privilege changes.
7. Separate development configuration without weakening production defaults.
8. Test login, logout, expiry, subdomains, redirects, embedded contexts, and cross-site requests in browsers.

Guardrails

• Cookie flags do not replace server-side authorization or CSRF defenses.
• Never store passwords, raw access tokens readable by scripts, or unnecessary personal data.
• Avoid sharing a cookie across every subdomain unless all subdomains have the same trust boundary.

Done

• A cookie inventory records purpose, flags, scope, owner, and lifetime
• Browser tests verify expected first-party and cross-site behavior
• Session rotation and deletion are recorded and reconciled with server state