Security attributes that are set on cookies when they are created. Secure: the cookie is sent only encrypted over HTTPS. HttpOnly: the cookie cannot be read by JavaScript, so it cannot be stolen via XSS. SameSite: the cookie is not sent from other websites, which prevents a CSRF attack.
FAQ / Glossary