Chapter 70: Permissions Policy & Modern Security Headers

Secure Cookie Attributes & Cookie Prefixes

**Part 14: Security & Best Practices** — Chapter 70: Feature Policy & Permissions Policy

LEARNING OBJECTIVES ⌵
  • Master the 4 essential cookie security flags: Secure, HttpOnly, SameSite=Strict|Lax, and Domain.
  • Understand cryptographic Cookie Prefixes (__Host- and __Secure-).
  • Prevent session hijacking, cookie tossing, and subdomain takeover exploits.
  • Configure zero-vulnerability authentication cookies.
🎬 INTERACTIVE VISUAL PIPELINE Core Architecture Simulation
🌐
1. Input
Directives & Tags
⚙️
2. Parse
Tokenizer & AST
🌳
3. Layout
Box Model & Flow
🎨
4. Render
GPU Paint & Composite
PHASE 1: INPUT & DIRECTIVES
Browser receives declarative markup stream, parsing tag tokens and initializing component state.

The Gold-Standard Secure Cookie Template

Set-Cookie: __Host-session_id=a9f1c04d8e2; 
  Path=/; 
  Secure; 
  HttpOnly; 
  SameSite=Strict; 
  Max-Age=86400

Why __Host- Prefix is the Industry Gold Standard:

  1. Must be HTTPS (Secure): Rejected over plain HTTP.
  2. Must have Path=/: Cannot be scoped to arbitrary subdirectories.
  3. Cannot have a Domain attribute: Locked strictly to the host domain, completely preventing malicious subdomains (attacker.yourdomain.com) from overwriting or tossing cookies!

📌 Key Takeaways

  • Always use HttpOnly on auth cookies so JavaScript (document.cookie) can never access session tokens.
  • Use __Host- prefix to guarantee that subdomains cannot tamper with top-level authentication state.
  • --

❓ Knowledge Check

1. Which of the following is correct?

2. Which of the following is correct?

🏋️ Study Exercise

Task: Review the http example above. Identify the key directives and their purpose, then try writing your own version from memory.

Set-Cookie: __Host-session_id=a9f1c04d8e2; Path=/; Secure; HttpOnly; SameSite=Strict; Max-Age=86400