--- title: "How can you secure your HTTP cookies against XSS attacks?" description: "How can you secure your HTTP cookies against XSS attacks?" author: "Shrikant Mishra" published: 2021-01-19 canonical: https://www.mindstick.com/interview/33767/how-can-you-secure-your-http-cookies-against-xss-attacks category: "node.js" tags: ["http", "https", "network", "xss", "ssl"] reading_time: 2 minutes --- # How can you secure your HTTP cookies against XSS attacks? [Cross site scripting (XSS)](https://www.mindstick.com/articles/1413/basics-of-cross-site-scripting-xss-attack-on-web-applications) occurs when the attacker injects executable JavaScript code into the HTML response. To reduce these attacks, we have to set flags on the set_cookies HTTP header: **HttpOnly** - it attribute is used to help prevent attacks such as cross-site scripting since it does not allow the cookie to be accessed via JavaScript. **Secure** - it attribute tells the browser to only send the cookie if the request is being sent over HTTPS. So it would look something like this: ``` Set-Cookie: sid=; HttpOnly. ``` Whether, you are using Express, with express-cookie session, it is working by default. ## Answers ### Answer by Shrikant Mishra [Cross site scripting (XSS)](https://www.mindstick.com/articles/1413/basics-of-cross-site-scripting-xss-attack-on-web-applications) occurs when the attacker injects executable JavaScript code into the HTML response. To reduce these attacks, we have to set flags on the set_cookies HTTP header: **HttpOnly** - it attribute is used to help prevent attacks such as cross-site scripting since it does not allow the cookie to be accessed via JavaScript. **Secure** - it attribute tells the browser to only send the cookie if the request is being sent over HTTPS. So it would look something like this: ``` Set-Cookie: sid=; HttpOnly. ``` Whether, you are using Express, with express-cookie session, it is working by default. --- Original Source: https://www.mindstick.com/interview/33767/how-can-you-secure-your-http-cookies-against-xss-attacks Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.