Comparison
HttpOnly cookievsSameSite cookie
HttpOnly cookie
the session cookie is invisible to `document.cookie`, so a script that gets injected cannot read it.
A cookie flag that hides the value from JavaScript entirely, leaving it usable only by the browser when making requests. Together with `Secure`, which restricts it to HTTPS, it is the reason session tokens belong in cookies rather than in `localStorage`. It limits the damage from XSS without preventing it: injected script can still make authenticated requests as the user, it just cannot exfiltrate the token.
Full entry →SameSite cookie
the cookie stopped being sent when the request came from another site, and an embedded widget broke.
A cookie attribute controlling whether the cookie is attached to requests originating from other sites: `Strict` never, `Lax` only on top-level navigations, `None` always but only over HTTPS. `Lax` is now the default, which removed most cross-site request forgery by default and broke a generation of embedded widgets and payment redirects at the same time. It is a defence in depth, not a replacement for a CSRF token on state-changing requests.
Full entry →