After login, apps track state via server sessions or signed tokens (JWT)—each has trade-offs.
Secure cookie flags
HttpOnly— JavaScript cannot read (mitigates XSS theft)Secure— HTTPS onlySameSite=Lax/Strict— reduces CSRF cookie delivery
JWT cautions
JWTs are signed, not encrypted by default—do not put secrets in payload. Short expiry + refresh rotation; revoke on logout is harder than server sessions.
Important interview questions and answers
- Q: HttpOnly?
A: Prevents document.cookie access from XSS scripts. - Q: JWT in localStorage?
A: Often discouraged—XSS can exfiltrate; HttpOnly cookie is safer for web.
Self-check
- Name three secure cookie attributes.
- JWT signed vs encrypted?
Pitfall: Long-lived JWT in localStorage—prefer HttpOnly session cookies for web.
Interview prep
- HttpOnly?
Cookie not readable by JavaScript—helps vs XSS theft.