FrontendHaltSecurity·Intermediate·Conceptual·1 min read
What cookie attributes matter for authentication?
Short interview answer
Secure limits transmission to HTTPS, HttpOnly prevents JavaScript access, and SameSite controls cross-site attachment. Narrow Domain and Path scope, short lifetimes, rotation, and server-side validation also matter. HttpOnly mitigates token theft through XSS but does not stop an injected script from making same-origin requests.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.