Topic
Cookies
Understand cookie storage, scope, transport, expiration, and security across HTTP headers, attributes, and session flows.
- Cookie Attributes
Cookie Prefixes: __Host- and __Secure- Rules
Cookie prefixes make the browser enforce attributes. The exact __Host- and __Secure- rules from RFC 6265bis, how to set them, and why a cookie vanishes.
- Guides
Cookie Security: HttpOnly, SameSite, and Secure Flags
A comprehensive guide to understanding and implementing secure HTTP cookies to protect against XSS, CSRF, and session hijacking attacks.
- Comparisons
Cookie-Based vs Session-Based Authentication
Cookies vs server-side sessions: where the state lives, what the cookie actually carries, security and scaling tradeoffs, and when to use each approach.
- Comparisons
Cookies vs localStorage vs sessionStorage: What to Use
Cookies vs localStorage vs sessionStorage: request behavior, size limits, expiry, tab scope, partitioning, XSS and CSRF risks, and auth token choices.
- Comparisons
CORS vs CSRF: Response Reads vs Forged Writes
CORS controls cross-origin response reads; CSRF abuses automatically sent credentials. Compare preflights, SameSite, tokens, Origin and Sec-Fetch-Site.
- Glossary
CSRF (Cross-Site Request Forgery)
CSRF tricks a logged-in browser into sending an unwanted request to your site. See how it works, why CORS does not stop it and which defenses actually do.
- Cookie Attributes
Domain
Learn how the Domain cookie attribute controls which domains can access cookies. Understand subdomain sharing, security implications, and restrictions.
- Debug Guides
ERR_TOO_MANY_REDIRECTS: Find and Break the Redirect Loop
Fix ERR_TOO_MANY_REDIRECTS (redirected you too many times): Cloudflare Flexible SSL, WordPress URLs, nginx HTTPS loops and cookie loops, diagnosed with curl.
- Cookie Attributes
Expires
Learn how the Expires cookie attribute sets an absolute expiration date. Understand date formats, timezone handling, and when to use Expires vs Max-Age.
- Guides
HTTP Sessions and State Management Explained
Learn how to manage user state and sessions in stateless HTTP applications using cookies, tokens, and server-side storage.
- Cookie Attributes
HttpOnly Cookie Attribute: XSS Protection
Learn how the HttpOnly cookie attribute protects against XSS attacks by preventing JavaScript access to sensitive cookies.
- Comparisons
JWT vs Session Cookies: Logout and Security
Compare stateless JWT bearer tokens with opaque session cookies: revocation, rotation, request size, browser storage, CSRF, XSS and algorithm validation.
- Cookie Attributes
Max-Age
Learn how the Max-Age cookie attribute sets expiration in seconds from now. Understand why Max-Age is preferred over Expires for reliable lifetime control.
- Debug Guides
nginx Upstream Sent Too Big Header: Fix the 502
Fix nginx upstream sent too big header: measure response headers, size proxy or FastCGI buffers, and shrink oversized Set-Cookie and redirect headers.
- Cookie Attributes
Partitioned Cookies (CHIPS): The Partitioned Attribute
The Partitioned cookie attribute (CHIPS) gives third-party embeds a separate cookie jar per top-level site. Syntax, Secure requirement, and browser support.
- Cookie Attributes
Path
Learn how the Path cookie attribute restricts which URL paths can receive cookies. Understand path matching rules and how to scope cookies to specific routes.
- Debug Guides
Request Header Or Cookie Too Large: Fix 400 and 431
Fix 400 Request Header Or Cookie Too Large and 431 errors: find the oversized cookie or token, then check nginx, Apache, Node, ALB and Cloudflare limits.
- Glossary
Same-Site vs Same-Origin
Site and origin are not the same. Learn how eTLD+1 and the Public Suffix List define same-site, and why it decides SameSite cookie and CORS behavior.
- Cookie Attributes
SameSite Cookie Attribute: Strict, Lax and None
How SameSite works: Strict, Lax and None, what counts as same-site, why Lax-by-default is Chromium behavior, and how to fix cookies blocked cross-site.
- Cookie Attributes
Secure
Learn how the Secure cookie attribute ensures cookies are only sent over HTTPS connections. Protect sensitive data from man-in-the-middle attacks.
- HTTP Headers
Set-Cookie Header: Attributes, Examples and Browser Rules
Set-Cookie syntax and every attribute: Expires, Max-Age, Domain, Path, Secure, HttpOnly, SameSite, Partitioned, __Host- prefixes, with Express and Django.
- Debug Guides
Why Is My Cookie Not Being Sent?
A step-by-step checklist for cookies missing from HTTP requests: Domain, Path, Secure, SameSite, fetch credentials, CORS, expiry and browser blocking.
More topics
- 63 pages
Security
Study HTTP security controls for transport, cookies, browser isolation, authentication, content policy, and response hardening.
- 24 pages
Performance
Improve HTTP delivery with caching, compression, connection reuse, timing signals, and response metadata.
- 22 pages
Caching
Learn how browsers and intermediaries store, validate, and reuse HTTP responses with cache directives, validators, and conditional requests.
- 22 pages
CORS
Trace cross-origin browser requests, preflight exchanges, response headers, credentials, and common CORS failure modes.