🍪
Session Cookie
Session Management
Cookie storing a session identifier; security depends on flags (Secure, HttpOnly, SameSite) and rotation.
Definition
A session cookie typically holds a session ID that maps to server-side state. Secure implementations use TLS, set Secure/HttpOnly/SameSite flags, rotate identifiers, and expire sessions appropriately.
In plain English
Cookie storing a session identifier; security depends on flags (Secure, HttpOnly, SameSite) and rotation.
Why this matters
Why it matters: Session hijacking can occur via theft, XSS, or network exposure; strong cookie flags and rotation reduce risk.
Example
Example: Use Secure+HttpOnly+SameSite=Lax/Strict, rotate on privilege changes, and invalidate on logout.