Web Security · Junior · Question 47 of 75

Which `Set-Cookie` line is the best choice for a session cookie?

1Set-Cookie: sid=...; Domain=.com; SameSite=None
✓Correct answer: Set-Cookie: sid=...; Secure; HttpOnly; SameSite=Lax; Path=/
3Set-Cookie: sid=...; Path=/

Explanation

Secure keeps it on HTTPS, HttpOnly hides it from scripts and SameSite=Lax blocks most cross-site sends.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.