Skip to content

Commit

Permalink
fixed formatting
Browse files Browse the repository at this point in the history
  • Loading branch information
eide-1 committed Nov 2, 2023
1 parent ed657f2 commit 3e23442
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion store-data-client-side.md
Original file line number Diff line number Diff line change
Expand Up @@ -52,4 +52,4 @@ An HTTP cookie is a string, that like local and session storage is stored in the
**Security:** Cookies are vulnerable to XSS and CSRF attacks, but they provide ways to mitigate such attacks:
- **HttpOnly**: The `HttpOnly` cookie header prevents the cookie from being accessed using JavaScript/TypeScript. Note that cookies created on the client side cannot be `HttpOnly`, which means they will remain insecure and vulnerable to XSS attacks. The `HttpOnly` cookie header can help mitigate XSS attacks, but is not sufficient on its own and should be combined with other properties (like `SameSite`) to improve the security of the web application.
- **SameSite:** The `SameSite` cookie attribute specifies rules on whether/when cookies are sent with cross-site requests. The `SameSite` header should be set to `Strict` to limit the cookie to HTTP requests to the same site where it originated. Setting this property to `Lax` can make your website vulnerable to CSRF and XSS attacks since the cookie will also be sent if a request to the website originates from another site.
- **Secure:** When **Secure** flag of a cookie is set to true, the cookie may only be transmitted using a secure connection (SSL/HTTPS). This measure prevents cookies from being observed by unauthorized parties due to the transmission of the cookies in plain text.
- **Secure:** When `Secure` flag of a cookie is set to true, the cookie may only be transmitted using a secure connection (SSL/HTTPS). This measure prevents cookies from being observed by unauthorized parties due to the transmission of the cookies in plain text.

0 comments on commit 3e23442

Please sign in to comment.