What are the methods of protecting Cookies?

• HttpOnly flag: Prevents JavaScript access to cookies, reducing the risk of XSS attacks.
• Secure flag: Sends cookies only over secure HTTPS connections.
• SameSite attribute: Controls the sending of cookies with cross-site requests, protecting against CSRF attacks. Values:
  • Strict: Cookies are sent only for requests to the same site from the same domain.
  • Lax: Cookies are sent for cross-site requests when the user navigates via an external link (e.g., GET request).
  • None: Cookies are sent with all cross-site requests (requires setting the Secure flag).
• Expiration control: Using the Expires or Max-Age attribute for automatic cookie deletion.
• Encryption: Encrypting sensitive data stored in cookies.
• Data minimization: Store only necessary information in cookies, such as session identifiers. Session data itself is better stored on the server.
• Protection against guessing: Use cryptographically secure session identifiers instead of easily predictable ones.
• Server-side validation: Always verify and validate cookie data on the server.

// Example of setting a cookie with security flags in Express.js
app.get('/', (req, res) => {
  res.cookie('session_id', 'some_session_token', {
    httpOnly: true, // Disallow access via JavaScript
    secure: true,   // Send only over HTTPS
    sameSite: 'Lax', // Restrict sending with cross-site requests
    maxAge: 3600000 // Lifetime of 1 hour (in milliseconds)
  });
  res.send('Cookie has been set!');
});