Authentication interview question · Most asked
How do you secure session cookies?
Summary
Set HttpOnly (no JavaScript access), Secure (HTTPS only), SameSite=Lax or Strict (limits cross-site sending), a narrow Path/Domain, sensible expiry, and use the __Host- prefix where possible. Regenerate the session ID on login and privilege change.
Longer Answer
Also enforce idle and absolute timeouts server-side, invalidate sessions on logout and password change, and store minimal data in the session. SameSite=None requires Secure and is needed only for legitimate cross-site use.
Key Points
- HttpOnly, Secure, SameSite
- __Host- prefix
- Regenerate ID on login
- Server-side timeouts and invalidation
More most-asked Authentication questions
- What is the difference between authentication and authorization?
- Compare session-based authentication with token-based (JWT) authentication.
- What are the most common JWT security pitfalls?
- What are OAuth 2.0 and OpenID Connect, and how do they differ?
- Explain the OAuth 2.0 Authorization Code flow with PKCE.
- How do refresh tokens work, and how do you secure them?
- How should passwords be stored?
- What is multi-factor authentication, and which factors are strongest?