How do cookies work? What are HttpOnly and SameSite flags? How to restrict cookies to a specific path?

Cookies are small data sent by a web server to a browser, which the browser stores and sends back on subsequent requests to the same server.

• HttpOnly is a flag that prevents access to the cookie via JavaScript (e.g., through document.cookie), enhancing security by preventing XSS attacks.
• SameSite restricts the sending of cookies to certain scenarios:
  • Strict — cookies are sent only with requests from the same site.
  • Lax — cookies are sent with navigation links, but not with cross-site requests.
  • None — cookies are sent always, but require the Secure flag (only over HTTPS).

To restrict a cookie to a specific path, the Path attribute is used. For example:

Set-Cookie: sessionId=abc123; Path=/app;

This means the cookie will only be sent by the browser for requests to URLs starting with /app.