Cookie security flags

httpOnly (no JS access), Secure (HTTPS only), SameSite (CSRF defence).

Code example

response.set_cookie(
    'access_token', token,
    httponly=True,        # JS can't read it
    secure=True,          # HTTPS only (prod)
    samesite='lax',       # CSRF defence
    max_age=3600,
)

How it works

Cookies have three critical security flags. httpOnly prevents JavaScript from reading the cookie — defeats XSS token theft. Secure ensures the cookie is only sent over HTTPS — defeats network sniffing. SameSite=Lax prevents the cookie from being sent on cross-site POST requests — defeats most CSRF attacks. OpenBenchML sets httpOnly and SameSite in dev; Secure is added in production (where HTTPS is terminated by the proxy).