Using security-related cookie attributes

Cookies are an essential part of web application development. It is a means to maintain a state in a stateless HTTP protocol and carry the most vital information that's used in security-like tokens and session data. As we learned in the Fixing information exposure through insecure cookies recipe of Chapter 7, Security Misconfiguration, the cookie attributes that we enable or disable a cookie's protection from abuse. In that recipe, we learned how the Secure and HTTP Only attributes make our cookies limited, in that they can either be sent only through secure transport, persist in the browser, or prevent arbitrary client-side scripts from reading their sensitive values.

In this recipe, we are going to learn how to use another security-related cookie attribute, SameSite. SameSite is a relatively new cookie attribute (at the time of writing) and is utilized to limit third-party websites from accessing a cookie marked with the context...