Sequenced Path
Cookie Security
A focused series on securing HTTP cookies — covering the HttpOnly and SameSite attributes and their role in defending against XSS and CSRF attacks.
Built for: Readers who want a sequential path through one topic from start to finish.
What you should get from this path
- Follow the material in a deliberate order.
- Build understanding progressively instead of jumping between isolated references.
Follow in order
Move through these entries in sequence for the clearest progression.
- Cookie Attributes
HttpOnly Cookie Attribute: XSS Protection
Learn how the HttpOnly cookie attribute protects against XSS attacks by preventing JavaScript access to sensitive cookies.
Part 1 · beginner in this sequenced learning path.
- Cookie Attributes
SameSite Cookie Attribute: Strict, Lax and None
How SameSite works: Strict, Lax and None, what counts as same-site, why Lax-by-default is Chromium behavior, and how to fix cookies blocked cross-site.
Part 2 · intermediate in this sequenced learning path.
More Learning Paths
- 12 linked
Debug HTTP Problems in Production
A pragmatic troubleshooting stack for the failures engineers see most often.
- 12 linked
Learn HTTP Fundamentals
A structured route through the core primitives, message flow, and debugging basics.
- 12 linked
Ship Secure Auth and Cookies
A security-focused path for login state, browser credentials, and defensive HTTP defaults.