Configure Secure and HttpOnly Cookies for Session Management

// Using Express.js for a typical Node.js web application
const express = require('express');
const app = express();
const cookieParser = require('cookie-parser');

app.use(cookieParser());

app.get('/set-secure-cookie', (req, res) => {
  // Example: Setting a session cookie
  res.cookie('session_token', 'your_secure_session_id_here', {
    httpOnly: true,        // Prevents client-side JavaScript from accessing the cookie
    secure: true,          // Ensures cookie is only sent over HTTPS
    sameSite: 'Lax',       // Mitigates CSRF attacks; 'Strict' is even stronger
    maxAge: 3600000,       // Cookie expires after 1 hour (in milliseconds)
    path: '/',             // Cookie is valid for all paths on the domain
    // domain: 'yourdomain.com' // Optional: Specify domain if different from request origin
  });
  res.send('Secure cookie set!');
});

app.get('/get-cookie', (req, res) => {
  // Accessing cookies (httpOnly cookies are not accessible via client-side JS)
  res.send(`Session token (server-side): ${req.cookies.session_token || 'Not found'}`);
});

// Start server
// app.listen(3000, () => {
//   console.log('Server running on port 3000');
// });