Q41: What security flags should be set on HTTP cookies in Node.js applications?
Set HttpOnly to block client-side JavaScript access (mitigating XSS), Secure to enforce HTTPS transmission, and SameSite=Strict or Lax to prevent Cross-Site Request Forgery (CSRF).
Key Takeaways
HttpOnlyprevents client script access to cookies.Secureensures HTTPS transmission;SameSiteprevents CSRF attacks.
Knowledge Check
Which cookie flag prevents client-side document.cookie access in browsers?