The answer
httpOnly (no script access), secure (HTTPS only), sameSite ('lax' or 'strict' for CSRF protection), maxAge (match token expiry), domain (for subdomain sharing), path (for restriction), and signed (tamper detection with cookie-parser).
Cookie Security in Node.js Explained
What are the security flags for cookies in Node.js?
More FAQs in Cookie Security in Node.js Explained
Scripts cannot read the cookie. Only the browser sends it on requests. Protects against XSS-driven cookie theft. Without httpOnly, any script (including injected ones) can read the cookie.
Controls when the cookie is sent on cross-site requests. 'strict' never sends it cross-site (strongest CSRF protection). 'lax' sends it on top-level navigations (good balance). 'none' always sends it (requires secure: true; use only for third-party embeds).
Otherwise the browser may not match the cookie and it will not be cleared. If you set httpOnly, secure, sameSite, you must clear with the same options. Otherwise the user stays logged in.
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.