Cookie attributes that limit exposure

Cookie hardening happens through Set-Cookie attributes and name prefixes. Prefix names with Host- for cookies needed only on a specific domain (no subdomains) where Path is set to /, and Secure- for all other cookies; both prefixes prevent cookies from being overwritten by insecure sources. Always set Secure so the cookie is transmitted only over HTTPS, and set HttpOnly on every cookie that does not require access from JavaScript — session identifiers above all. Cookies should expire as soon as they are no longer needed: Expires sets an absolute expiration date, Max-Age a relative one, and Max-Age is less error-prone and takes precedence when both are set; if neither is set, the cookie is kept until the user closes the browser and is then discarded. Restrict Domain and Path to the tightest scope the application needs. Setting SameSite to Strict or Lax restricts cookie transmission in requests that originate from a different site, defending against cross-site request forgery (CSRF), clickjacking, and some cross-site leak attacks. Scope: Web security. Reviewed October 4, 2026.