SESSION SECURITY

COOKIES

We use HTTP-only session cookies with SameSite controls so login state is not exposed to scripts and cross-site request risk is reduced. Production traffic uses HTTPS / TLS 1.3 where supported.

What we set

Authentication cookies are HTTP-only, Secure in production, and SameSite=Lax. They store a session, not a password. Client-side JavaScript cannot read these cookies.

Why

HTTP-only cookies reduce the impact of XSS. SameSite cookies reduce CSRF. We do not use cookies to sell a user directory to advertisers. Session cookies support our zero-harvesting credential privacy model.