Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
Which single cookie attribute most directly prevents a successful XSS injection from stealing a session token via document.cookie?
💻 Code Challenge | +75 XP
Configure a session cookie in Express with HttpOnly, Secure, SameSite=Lax, and a 24-hour maxAge, and verify the resulting Set-Cookie header in DevTools.
A security audit found a session cookie is missing the HttpOnly attribute, making it readable by an XSS payload. Reorder the steps to fix it correctly.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Setting a session cookie without the HttpOnly attribute
// Wrong: readable by any injected script
res.cookie("sessionId", token);
// Correct
res.cookie("sessionId", token, { httpOnly: true, secure: true, sameSite: "lax" });The Solution //
Without HttpOnly, client-side JavaScript can read the session cookie via document.cookie — meaning any successful XSS injection anywhere on the site can steal the cookie and exfiltrate it to an attacker, fully hijacking the session. Always set httpOnly: true on session and authentication cookies.
The Error //
Testing locally over HTTP with secure: true and being confused when the cookie never appears
// Correct pattern for local dev
res.cookie("sessionId", token, {
httpOnly: true,
secure: process.env.NODE_ENV === "production",
sameSite: "lax",
});The Solution //
A cookie with the Secure attribute is only ever sent (or even set) over an HTTPS connection by design — testing against a plain http://localhost server means the browser silently drops it, which can look like a broken cookie implementation rather than the correct, expected behavior. Use a local HTTPS setup for testing, or conditionally disable secure only in local development.