VibeSecurity

Security check

Cookie security flags: HttpOnly, Secure, SameSite and the __Host- prefix

A session cookie is the key to an account. A few attributes decide whether scripts can read it, whether it travels over plain HTTP and whether other sites can trigger requests with it.

By the VibeSecurity team1 min read

What each attribute does

  • HttpOnly: page scripts cannot read the cookie, which limits the impact of XSS.
  • Secure: the browser sends it only over HTTPS.
  • SameSite: controls whether the cookie is sent on cross-site requests. Lax is a good default, Strict is tighter.
  • Path and Domain: keep them narrow. Omitting Domain keeps the cookie on the exact host.
  • Max-Age or Expires: shorter lifetimes reduce the window after theft.

Setting it in Next.js

Route handler
import { cookies } from 'next/headers';

const jar = await cookies();
jar.set('__Host-session', token, {
  httpOnly: true,
  secure: true,
  sameSite: 'lax',
  path: '/',
  maxAge: 60 * 60 * 24,
});

Check what you send

Terminal
curl -sI https://your-app.example/login | grep -i set-cookie

Frequently asked questions

Why use the __Host- prefix?

Browsers only accept it when the cookie is Secure, has Path=/ and has no Domain attribute, so a sibling subdomain cannot overwrite it.

Should I store a JWT in localStorage instead?

An HttpOnly cookie is safer against XSS, since scripts cannot read it. Pair it with SameSite and origin checks.

Sources

  1. 1.MDN: HTTP cookies
  2. 2.OWASP Session Management Cheat Sheet