Cookie Security
HttpOnly & SameSite
0 / 7 solved
Observe how real browser cookie attributes change XSS and cross-site request behavior.
Quick reference
Cookie security cheat sheet
Check cookie attributes in real responses, then reproduce the exact browser context that decides whether JavaScript or a cross-site request can use them.
Where to look
- Login responses and refresh/token endpoints that send Set-Cookie headers.
- Session, authentication, remember-me, CSRF, and privileged workflow cookies in DevTools or Burp.
- State-changing routes that can be reached by links, forms, iframes, images, or cross-origin navigation.
HttpOnly checks
- Inspect Set-Cookie. A sensitive session cookie should normally include HttpOnly.
- With an XSS sink, test document.cookie. HttpOnly cookies should be absent from the JavaScript-visible result.
- Do not stop there: XSS can still send same-origin fetch requests and the browser can attach HttpOnly cookies automatically.
document.cookiefetch('/account').then(r => r.text())Set-Cookie: session=...; HttpOnly; Secure; SameSite=LaxSameSite workflow
- First decide whether the request is same-site or cross-site; origin and site are not identical concepts.
- For Lax cross-site behavior ask: is this a top-level navigation, and is the method safe (GET/HEAD)? Both matter.
- Compare a normal link, an iframe, and a POST form while watching the real Cookie, Origin, and Referer headers.
- Strict withholds cookies on cross-site entry. None permits cross-site use but modern browsers require Secure, and browser third-party-cookie policies can still restrict it.
<a href='https://VICTIM/account'>top-level GET</a><iframe src='https://VICTIM/account'></iframe><form method='POST' action='https://VICTIM/transfer'>...</form>Realistic tips
- Use two genuinely different sites for SameSite testing. In production configure VITE_LAB_CROSS_SITE_ORIGIN to a second registrable domain; a subdomain of the victim is not enough for SameSite testing.
- Changing only the path or port does not make two URLs different sites for SameSite purposes.
- A SameSite cookie is defense-in-depth, not a replacement for CSRF-safe methods, CSRF tokens, origin checks, or proper XSS prevention.
- Record the request method, top-level/embedded context, Cookie header, Origin, and Referer before drawing conclusions.