Web Technology Basics
Set-Cookie: sid=8f3a2c9d; Path=/; Secure; HttpOnly; SameSite=LaxWhich of the following correctly describes the cookie set by the header above?
- ABecause of the Secure attribute, the cookie value is stored encrypted in the browser and cannot be read by other applications
- BBecause of the HttpOnly attribute, the page's JavaScript cannot read this cookie
- CBecause of SameSite=Lax, this cookie is not attached even to requests sent from pages within the same site
Show answer and explanation
Answer: B. Because of the HttpOnly attribute, the page's JavaScript cannot read this cookie
A cookie with the Secure attribute is sent only over HTTPS. With the HttpOnly attribute, the page's JavaScript cannot read it through document.cookie and the like, which reduces the damage if a session ID would otherwise be stolen through XSS. The SameSite attribute decides whether the cookie is attached to requests started from other sites; with Lax it is attached to GET navigations that follow a link from another site, but not to form POSTs from other sites or to image loads. A cookie without an expiry set by Expires or Max-Age generally becomes a session cookie that is deleted when the browser is closed.
- A. Secure is an attribute that makes the cookie be sent only over HTTPS; it does not encrypt the stored value.
- B. Correct. An HttpOnly cookie cannot be read by scripts, which reduces the damage from theft through XSS.
- C. SameSite decides whether the cookie is attached to requests started from other sites; it is attached to requests within the same site.