- 1 current stop: learning
- 2 upcoming
- 3 upcoming
- 4 upcoming
- 5 upcoming
Finish after stop 5
Stop 1 of 5 · Cookie jar shelf: three lids
Trick to keep in mind+3 XP
HttpOnly: no script peeking. Secure: HTTPS van only. SameSite: no cross-site errands.
Each cookie attribute blocks a different route. One shields the value from code running in the page, which limits what injected script can steal. One keeps the cookie off plain HTTP connections. One restricts sending it along with requests started by other sites. A lifetime setting is separate: it controls how long the cookie lasts, not who can read it.
Read it once, then a question tests whether the trick stuck.