https://shipreadyai.dev/glossary/cookie-flags

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Cookie flags

The three settings that decide how safely a cookie travels.

A session cookie is the thing that keeps someone signed in. Three flags decide how well it is protected. Secure means it is only ever sent over HTTPS. HttpOnly means JavaScript cannot read it, so an injected script cannot steal it. SameSite controls whether it travels on requests started by other sites.

Defaults are not always right, and frameworks differ. A cookie without HttpOnly turns any scripting bug into an account takeover. A cookie without SameSite turns a link on another site into an action taken as your user.

A check reads the cookies your published app sets and reports the flags it sees, so this one is observable rather than declared. Setting them is a small change in the one place your app creates sessions.