Secure Cookie Configuration with AI Prompts

Audit all cookies my application sets for security issues.

For each cookie, check:

1. HttpOnly: Is it set? (Required for auth cookies)
2. Secure: Is it set? (Required for production)
3. SameSite: What value? (Lax minimum for auth)
4. Domain: Is it properly scoped?
5. Path: Is it properly scoped?
6. Max-Age/Expires: Appropriate lifetime?

Find all places cookies are set:

• res.cookie() calls
• Set-Cookie headers
• document.cookie assignments
• Framework session configuration

Flag issues:

• Session/auth cookies without HttpOnly
• Any cookie without Secure in production
• SameSite=None without Secure
• Overly broad Domain scope
• Very long expiration for session cookies

Configure my session cookie with proper security attributes.

Framework: Next.js/Express/Django

Recommended settings: Set-Cookie: session=value; HttpOnly; Secure; SameSite=Lax; Path=/

Express example: res.cookie('session', sessionId, { httpOnly: true, // Not accessible via JavaScript secure: true, // HTTPS only sameSite: 'lax', // CSRF protection path: '/', // Available site-wide maxAge: 24 * 60 * 60 * 1000, // 24 hours // domain: omit unless needed for subdomains });

For development (HTTP localhost): secure: process.env.NODE_ENV === 'production'

Note: SameSite=Strict breaks OAuth flows SameSite=Lax is usually the right choice

Choose the right SameSite value for my cookies.

SameSite options:

Strict:

• Cookie only sent for same-site requests
• Most secure but can break legitimate flows
• User clicking link from email won't be logged in
• Use for: high-security banking, admin panels

Lax (Recommended default):

• Sent for same-site + top-level navigation
• Good balance of security and usability
• User clicking link from email stays logged in
• Use for: most session cookies

None:

• Sent with all requests (cross-site too)
• Must be used with Secure
• Needed for: cross-site iframes, third-party contexts
• Use sparingly and only when required

Examples: // Standard session sameSite: 'lax'

// Admin session (extra security) sameSite: 'strict'

// Third-party widget that needs auth sameSite: 'none', secure: true

Use cookie prefixes for additional security enforcement.

Cookie prefixes tell browsers to require certain attributes:

__Secure- prefix:

• Cookie must have Secure attribute
• Must be set over HTTPS Set-Cookie: __Secure-session=value; Secure; ...

__Host- prefix (strictest):

• Must have Secure attribute
• Must NOT have Domain attribute
• Path must be /
• Prevents subdomain attacks Set-Cookie: __Host-session=value; Secure; Path=/

Using __Host- prefix: res.cookie('__Host-session', value, { httpOnly: true, secure: true, sameSite: 'lax', path: '/' // No domain attribute! });

Benefits:

• Browser enforces security even if code has bugs
• __Host- prevents subdomain cookie injection attacks
• Defense in depth