sxsphinxstack

Skills / Starter / Configure secure cookies

Starter Web skill

Configure secure cookies

Configure browser cookies with narrow scope, transport protection, script isolation, and deliberate cross-site behavior.

Give each cookie the least reach and lifetime needed for its documented purpose.

Procedure

  1. Inventory cookie name, owner, value type, purpose, sensitivity, scope, and lifetime.
  2. Set Secure for HTTPS transport and HttpOnly whenever scripts do not need the value.
  3. Choose SameSite=Strict, Lax, or None from the actual cross-site flow; pair None with Secure.
  4. Narrow Path and omit Domain when a host-only cookie is sufficient.
  5. Prefer __Host- or __Secure- prefixes when their constraints match the design.
  6. Use session or explicit Max-Age lifetimes and rotate authentication cookies after privilege changes.
  7. Separate development configuration without weakening production defaults.
  8. Test login, logout, expiry, subdomains, redirects, embedded contexts, and cross-site requests in browsers.

Guardrails

  • Cookie flags do not replace server-side authorization or CSRF defenses.
  • Never store passwords, raw access tokens readable by scripts, or unnecessary personal data.
  • Avoid sharing a cookie across every subdomain unless all subdomains have the same trust boundary.

Related skills

  • Check a site search result — Check an internal site-search result for relevance, accuracy, access control, highlighting, navigation, empty states, and freshness.
  • Create a 404 page — Create a useful 404 page with a real not-found status, accessible navigation, safe search or recovery choices, and consistent site identity.
  • Check a page title and description — Check a web page title and meta description for unique intent, accurate content, useful context, and rendered implementation.