147
session cookie
HttpOnly, Secure, SameSite. The script does not need to read the session token.
What is session cookie?
A session cookie identifies the server-side session. `HttpOnly` keeps JS from reading it. `Secure` keeps it off plain HTTP. `SameSite` cuts a class of CSRF. The token in `localStorage` is visible to any XSS. That is a worse trade for a session.
Why does session cookie matter when vibe coding?
Models store the JWT in localStorage because the tutorial did. Any XSS is then account takeover. Name the cookie flags.
How do you do session cookie?
Server session or a cookie the script cannot read. Set the three flags. Rotate the id on login. Logout deletes the server session, not only the cookie.
How do you ask a model for session cookie?
Keep the session in an HttpOnly, Secure, SameSite cookie. Do not put the session token in localStorage or a JS-readable cookie. Rotate it on login. Logout invalidates it on the server.
What goes wrong with session cookie?
SameSite=None without Secure, or None on a site that did not need cross-site cookies. Lax is the default you probably wanted.