Secure cookie attributes in Cybersecurity - Mini Project: Build & Apply

Secure Cookie Attributes

📖 Scenario: You are working on a website that needs to keep user sessions safe. Cookies help remember users, but if not set properly, they can be stolen or misused by attackers.To protect cookies, you must add special settings called attributes that control how cookies behave and who can access them.

🎯 Goal: You will create a cookie string with secure attributes to protect user data. This includes setting the cookie name and value, then adding attributes like Secure, HttpOnly, and SameSite to make the cookie safer.

📋 What You'll Learn

Create a cookie string with a name and value

Add a Secure attribute to allow cookie only over HTTPS

Add an HttpOnly attribute to prevent JavaScript access

Add a SameSite attribute to control cross-site sending

💡 Why This Matters

🌍 Real World

Web developers use secure cookie attributes to protect user sessions and sensitive data from theft or misuse.

💼 Career

Understanding secure cookie settings is essential for cybersecurity roles, web development, and IT security to build safer web applications.

1

Create the basic cookie string

Create a variable called cookie and set it to the string sessionId=abc123 representing the cookie name and value.

Cybersecurity

# Create the cookie string with name and value
# Your code here

Hint

Cookies are usually written as name=value pairs.

2

Add the Secure attribute

Add the Secure attribute to the cookie string by appending "; Secure" to it. This ensures the cookie is sent only over HTTPS.

Cybersecurity

cookie = "sessionId=abc123"
# Append the Secure attribute to cookie
# Your code here

Hint

Use string concatenation with += to add attributes.

3

Add the HttpOnly attribute

Add the HttpOnly attribute to the cookie string by appending "; HttpOnly". This prevents JavaScript from accessing the cookie.

Cybersecurity

cookie = "sessionId=abc123"
cookie += "; Secure"
# Append the HttpOnly attribute to cookie
# Your code here

Hint

Keep adding attributes separated by semicolons.

4

Add the SameSite attribute

Add the SameSite=Strict attribute to the cookie string by appending "; SameSite=Strict". This restricts the cookie from being sent with cross-site requests.

Cybersecurity

cookie = "sessionId=abc123"
cookie += "; Secure"
cookie += "; HttpOnly"
# Append the SameSite=Strict attribute to cookie
# Your code here

Hint

Use SameSite=Strict to block cross-site cookie sending.

Practice

1. Which cookie attribute ensures that a cookie is only sent over secure HTTPS connections?

easy

A. SameSite

B. HttpOnly

C. Secure

D. Domain

Solution

1. Step 1: Understand the Secure attribute purpose

   The Secure attribute restricts cookie transmission to HTTPS only, preventing sending over insecure HTTP.

2. Step 2: Compare with other attributes

   HttpOnly prevents JavaScript access, SameSite controls cross-site sending, Domain sets cookie scope. Only Secure enforces HTTPS.

3. Final Answer:

   Secure -> Option C

4. Quick Check:

   Secure = HTTPS only [OK]

Hint: Secure means HTTPS only, no insecure sending [OK]

Common Mistakes:

• Confusing HttpOnly with Secure
• Thinking SameSite controls HTTPS
• Assuming Domain affects security

2. Which of the following is the correct way to set a cookie with the HttpOnly attribute in an HTTP header?

easy

A. Set-Cookie: sessionId=abc123; httpOnly

B. Set-Cookie: sessionId=abc123; HttpOnly

C. Set-Cookie: sessionId=abc123; HTTPONLY

D. Set-Cookie: sessionId=abc123; Http-only

Solution

1. Step 1: Check correct attribute spelling and casing

   HttpOnly must be spelled as 'HttpOnly' without spaces or hyphens.

2. Step 2: Validate options

   Set-Cookie: sessionId=abc123; HttpOnly uses correct spelling and casing. Others have non-standard casing or hyphenation.

3. Final Answer:

   Set-Cookie: sessionId=abc123; HttpOnly -> Option B

4. Quick Check:

   HttpOnly attribute uses standard casing [OK]

Hint: HttpOnly standard casing: capital H and O [OK]

Common Mistakes:

• Using lowercase 'httponly'
• Adding hyphens like 'Http-only'
• Using all uppercase 'HTTPONLY'

3. Consider this Set-Cookie header:
Set-Cookie: id=123; Secure; HttpOnly; SameSite=Strict
Which of the following is true about this cookie?

medium

A. It will only be sent over HTTPS and not accessible via JavaScript.

B. It will be sent with cross-site requests regardless of origin.

C. It is not restricted to HTTPS and can be sent over HTTP.

D. It can be accessed by JavaScript on the client side.

Solution

1. Step 1: Analyze Secure and HttpOnly attributes

   Secure means cookie sent only over HTTPS. HttpOnly means JavaScript cannot access it.

2. Step 2: Understand SameSite=Strict effect

   SameSite=Strict prevents sending cookie with cross-site requests, enhancing security.

3. Final Answer:

   It will only be sent over HTTPS and not accessible via JavaScript. -> Option A

4. Quick Check:

   Secure + HttpOnly + SameSite=Strict = HTTPS only, no JS access [OK]

Hint: Secure + HttpOnly means HTTPS only and no JS access [OK]

Common Mistakes:

• Thinking HttpOnly allows JavaScript access
• Assuming SameSite=Strict allows cross-site sending
• Ignoring Secure attribute effect

4. A developer sets a cookie with this header:
Set-Cookie: token=abc; Secure; SameSite=None
Users report the cookie is not sent in some browsers. What is the likely issue?

medium

A. SameSite=None requires Secure attribute, which is missing.

B. HttpOnly attribute is missing, causing cookie to be blocked.

C. SameSite=None is invalid and blocks the cookie.

D. Secure attribute requires HTTPS, but site uses HTTP.

Solution

1. Step 1: Understand Secure attribute requirement

   Secure cookies are only sent over HTTPS connections. If site uses HTTP, cookie won't be sent.

2. Step 2: Check SameSite=None and Secure relation

   SameSite=None requires Secure attribute to be set, which is done here, so no issue.

3. Final Answer:

   Secure attribute requires HTTPS, but site uses HTTP. -> Option D

4. Quick Check:

   Secure cookie + HTTP site = cookie not sent [OK]

Hint: Secure cookies need HTTPS; HTTP sites block them [OK]

Common Mistakes:

• Thinking SameSite=None alone blocks cookies
• Assuming HttpOnly is required for sending
• Ignoring HTTPS requirement for Secure

5. A website wants to protect user session cookies from being stolen via cross-site scripting (XSS) and cross-site request forgery (CSRF). Which combination of cookie attributes best achieves this?

hard

A. Secure; HttpOnly; SameSite=Strict

B. HttpOnly; SameSite=None

C. Secure; SameSite=Lax

D. SameSite=Strict only

Solution

1. Step 1: Prevent XSS with HttpOnly

   HttpOnly prevents JavaScript access to cookies, reducing XSS risk.

2. Step 2: Prevent CSRF with SameSite=Strict and Secure

   SameSite=Strict blocks cross-site requests sending cookies, preventing CSRF. Secure ensures cookies sent only over HTTPS, adding protection.

3. Final Answer:

   Secure; HttpOnly; SameSite=Strict -> Option A

4. Quick Check:

   HttpOnly + Secure + SameSite=Strict = best XSS and CSRF protection [OK]

Hint: Use all three: Secure, HttpOnly, SameSite=Strict for best safety [OK]

Common Mistakes:

• Using SameSite=None which allows cross-site sending
• Omitting Secure attribute on HTTPS sites
• Relying on SameSite only without HttpOnly