Secure cookie attributes in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to set a cookie that is only sent over HTTPS.

Cybersecurity

Set-Cookie: sessionId=abc123; [1]

Drag options to blanks, or click blank then click option'

ASecure

BHttpOnly

CSameSite=Strict

DPath=/

Attempts:

3 left

💡 Hint

Common Mistakes

Using HttpOnly instead of Secure to restrict transmission.

Omitting the Secure attribute when using HTTPS.

The Secure attribute ensures the cookie is only sent over HTTPS connections, protecting it from being sent over insecure HTTP.

2fill in blank

medium

Complete the code to prevent JavaScript from accessing the cookie.

Cybersecurity

Set-Cookie: userToken=xyz789; [1]

Drag options to blanks, or click blank then click option'

AHttpOnly

BSecure

CSameSite=Lax

DDomain=example.com

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing Secure with HttpOnly.

Not setting HttpOnly on sensitive cookies.

The HttpOnly attribute prevents client-side scripts like JavaScript from accessing the cookie, reducing the risk of cross-site scripting attacks.

3fill in blank

hard

Fix the error in the cookie attribute to prevent cross-site request forgery.

Cybersecurity

Set-Cookie: auth=token123; SameSite=[1]

Drag options to blanks, or click blank then click option'

ADisabled

BNone

CLax

DStrict

Attempts:

3 left

💡 Hint

Common Mistakes

Using SameSite=None without Secure attribute.

Using an invalid value like Disabled.

The SameSite=Strict attribute restricts the cookie to same-site requests only, helping prevent cross-site request forgery (CSRF) attacks.

4fill in blank

hard

Fill both blanks to set a cookie that is secure and inaccessible to JavaScript.

Cybersecurity

Set-Cookie: id=456def; [1]; [2]

Drag options to blanks, or click blank then click option'

ASecure

BHttpOnly

CSameSite=Lax

DPath=/

Attempts:

3 left

💡 Hint

Common Mistakes

Using SameSite instead of HttpOnly to hide cookie from scripts.

Omitting Secure when using HttpOnly.

Using both Secure and HttpOnly attributes ensures the cookie is sent only over HTTPS and is not accessible via JavaScript, enhancing security.

5fill in blank

hard

Fill all three blanks to create a cookie that is secure, inaccessible to JavaScript, and restricted to same-site requests.

Cybersecurity

Set-Cookie: token=abc456; [1]; [2]; [3]

Drag options to blanks, or click blank then click option'

ASecure

BHttpOnly

CSameSite=Strict

DDomain=example.com

Attempts:

3 left

💡 Hint

Common Mistakes

Using SameSite=None without Secure attribute.

Forgetting HttpOnly on sensitive cookies.

Not setting SameSite to Strict for CSRF protection.

Combining Secure, HttpOnly, and SameSite=Strict attributes provides strong protection by ensuring the cookie is sent only over HTTPS, hidden from JavaScript, and restricted to same-site requests.