#BackToBasics: HTTP Cookies
summary
A technical history and practical guide to HTTP cookies: how they evolved from Netscape (1994), how Domain and Path attributes work, and how cookies can enable CSRF (demonstrated by loading an image that triggers an authenticated state change). Explains cookie attributes and mitigations—Expires/Max-Age, Path, Domain, Secure, HttpOnly, HSTS, Public Suffix List, cookie prefixes, SameSite—and notes browser quirks (ports ignored); recommends strict settings such as using _Host- cookies with Path=/, Secure, HttpOnly and no Domain.
AI-written summary · about
chapters (4)
- 0:00Start
- 5:32the best tag of all time!
- 13:28How to request cookie deletion?
- 24:34Secure restricts the cookie to secure requests
