Question

A web application developer is reviewing security settings after a penetration test found that session cookies could be transmitted over unencrypted HTTP and accessed by client-side scripts. Which combination of cookie attributes should the developer set to best mitigate these findings?

Accepted Answer

Set the Secure and HttpOnly attributes on the session cookie

Answer

Set the Domain and Path attributes to restrict cookie scope

Answer

Set the Max-Age and Expires attributes to shorten cookie lifetime

Answer

Set the SameSite=None and Partitioned attributes on the cookie