Secure

Adding the Secure parameter ensures the cookie is only transmitted over HTTPS and is not sent over unencrypted HTTP connections:

document.cookie = 'name=Flavio; Secure;'

Note that this does not make cookies secure; avoid storing sensitive information in cookies.

HttpOnly

A useful parameter is HttpOnly, which makes cookies inaccessible via the document.cookie API so they can only be set and read by the server:

document.cookie = 'name=Flavio; Secure; HttpOnly'

SameSite

SameSite allows servers to require that a cookie is only sent on same-site requests (where the request origin matches the cookie domain), which helps reduce the risk of CSRF (Cross-Site Request Forgery) attacks.

Lessons in this unit:

0:	Introduction
1:	Setting cookies
2:	Setting a cookie expiration date
3:	Setting a cookie path
4:	Setting a cookie domain
5:	▶︎ Cookies security
6:	Updating a cookie
7:	Deleting a cookie
8:	Accessing the value of a cookie
9:	Checking if a cookie exists
10:	Inspecting cookies
11:	Cookie not being set in Safari