Glossary: Web App Security and Authentication

HttpOnly

Also written: Secure, SameSite

Cookie flags: HttpOnly hides the cookie from page scripts, Secure sends it only over HTTPS, and SameSite (Strict, Lax or None) limits sending it on cross-site requests.