Engrain by ByteRush

WEB.05.01 Mid-level· 12 minCore — asked often

Cookies in depth: every Set-Cookie attribute and when to use it

What Domain, Path, Expires, Max-Age, Secure, HttpOnly, SameSite and Partitioned really do, the __Host- prefix, size limits, and where third-party cookies stand in each browser today.

Comes up in: Web fundamentals, Recruiter screen

Learn#

Aditya’s banking demo stores the session token in a cookie. A cross-site scripting bug lets an attacker’s script read document.cookie and send the token away. One attribute would have stopped it.

A cookie is a small name and value that the browser keeps for a site. It sends it back in the Cookie header. The server controls it with attributes:

Set-Cookie: __Host-session=8f2c; Path=/; Max-Age=604800; Secure; HttpOnly; SameSite=Lax

Max-Age or Expires keeps it after the browser closes. Without them, it is a session cookie. Secure sends it only over HTTPS. HttpOnly hides it from JavaScript, which stops scripts from stealing it. SameSite controls whether it goes with requests started by other sites. Strict means never. Lax means only when the user follows a link to you. None means always, and it requires Secure.

A first-party cookie belongs to the site in the address bar; a third-party cookie belongs to another site embedded in the page, such as an ad frame.

A well-configured session cookie at workStep 1 of 4

Network

  • POST /login → 200
  • Set-Cookie: __Host-session=…; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=604800

Console

    empty

    Login succeeds. The server sends Set-Cookie with __Host-, Secure, HttpOnly and SameSite=Lax.

    Read the steps as text
    1. Login succeeds. The server sends Set-Cookie with __Host-, Secure, HttpOnly and SameSite=Lax.
    2. Your own pages send the cookie with every request to this exact host.
    3. A script injected into the page tries document.cookie. HttpOnly hides the session from JavaScript.
    4. Another site auto-submits a form POST to your /transfer. SameSite=Lax keeps the cookie off that cross-site POST.

    Predict#

    Predict first

    In Chrome, a cookie is set with no SameSite attribute. Another site submits a form POST to yours. Is the cookie sent?

    Interview angle#

    Say it like this — about 30 seconds

    “HttpOnly hides a cookie from JavaScript, so an XSS bug cannot read it. Secure sends it only over HTTPS. SameSite controls cross-site sending: Strict never, Lax only on top-level navigations, None always but only with Secure. Chromium treats a missing SameSite as Lax, other browsers may not, so I set it explicitly. For sessions I use the __Host- prefix, which forces Secure, Path=/ and no Domain. Third-party cookies are blocked or partitioned in Safari and Firefox; Chrome still allows them.”

    Stays on your device. Nothing is uploaded.
    Follow-up What do HttpOnly, Secure and SameSite do?
    HttpOnly: not readable by JavaScript. Secure: HTTPS only. SameSite: whether it goes with cross-site requests.
    Follow-up What does the Domain attribute change?
    With Domain, the cookie goes to that domain and all subdomains; without it, only to the exact host that set it, which is safer.
    Follow-up What is CHIPS?
    The Partitioned attribute: a third-party cookie stored separately for each top-level site, so it cannot track users across sites.

    Practice#

    Guided

    Write a Set-Cookie builder that refuses unsafe combinations, the rules browsers enforce.

    Done when

    • Attributes appear in the given order, only when set.
    • __Host- cookies must be Secure, have Path=/ and no Domain.
    • SameSite=None and Partitioned both require Secure.
    Your solution
    Ctrl/⌘ + Enter

    Remember#

    Try to answer each card before you open it. Then add them to your reviews.

    What does HttpOnly do?

    Hides the cookie from JavaScript (document.cookie).

    SameSite=Lax: when is the cookie sent cross-site?

    Only on top-level navigations such as following a link (safe methods).

    What does the __Host- prefix require?

    Secure, Path=/ and no Domain attribute.

    What does SameSite=None require?

    The Secure attribute.

    Go deeper

    Four layers. Stop at the one your interview needs; each ends with a quick check.

    The core ideaEvery round

    Max-Age wins over Expires if both are set. Chrome caps lifetimes at 400 days. Path limits which URLs get the cookie. It is not a security wall: other pages on the same origin can still read it.

    Check yourself: What is a session cookie?

    A cookie with no Expires or Max-Age; it is deleted when the browser session ends.

    How it works underneathSenior rounds
    A cookie named __Host-… is accepted only if it is Secure, has Path=/ and no Domain, so a subdomain or plain-HTTP page cannot plant or overwrite it. __Secure- only requires Secure .
    Check yourself: Why use __Host- for a session cookie?

    It cannot be set by subdomains or over HTTP, so it cannot be overwritten that way.

    Edge cases and trapsWhere people slip

    Browsers allow about 4 KB per cookie, counting name and value, and dozens per domain. Every request carries them, so big cookies slow every request.
    Partitioned (CHIPS) stores a third-party cookie per top-level site: Chrome 114, Firefox 141, Safari 26.2.

    Check yourself: About how large can one cookie be?

    About 4 KB for name plus value.

    In productionStaff-level answers

    Chrome allows third-party cookies by default and, since April 2025, plans no new prompt; Safari blocks them; Firefox partitions them by site .
    Design login and embeds to work without third-party cookies anyway.

    Check yourself: Does Chrome block third-party cookies by default today?

    No. Chrome allows them by default; Safari blocks them and Firefox partitions them.

    Finished the five steps? Mark it, and its cards join your reviews.

    Last checked 2026-11-01. Spot a mistake? Use “Report an error” below — fixes are listed on the corrections page.

    Interview questions this answers

    • What do HttpOnly, Secure and SameSite do?