Next.js

1 Set cookie options when creating cookies in middleware or API routes

typescript

// When setting cookies
cookies().set('session', value, {
  secure: true,
  httpOnly: true,
  sameSite: 'lax',
  path: '/',
});

Express

1 Set secure cookie options in your session middleware

javascript

app.use(session({
  cookie: {
    secure: true,
    httpOnly: true,
    sameSite: 'lax',
  },
}));

Django

1 Set secure cookie settings in settings.py

python

# settings.py
SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = 'Lax'
CSRF_COOKIE_SECURE = True
CSRF_COOKIE_HTTPONLY = True

Laravel

1 Update cookie settings in config/session.php

php

// config/session.php
'secure' => true,
'http_only' => true,
'same_site' => 'lax',

Rails

1 Configure session cookie options

ruby

# config/initializers/session_store.rb
Rails.application.config.session_store :cookie_store,
  secure: Rails.env.production?,
  httponly: true,
  same_site: :lax

Spring Boot

1 Configure cookie settings in application.properties

properties

# application.properties
server.servlet.session.cookie.secure=true
server.servlet.session.cookie.http-only=true
server.servlet.session.cookie.same-site=lax

ASP.NET

1 Configure cookie policy in Program.cs

csharp

builder.Services.Configure<CookiePolicyOptions>(options =>
{
    options.Secure = CookieSecurePolicy.Always;
    options.HttpOnly = HttpOnlyPolicy.Always;
    options.MinimumSameSitePolicy = SameSiteMode.Lax;
});

Flask

1 Set cookie configuration in your Flask app

python

# app.py
app.config.update(
    SESSION_COOKIE_SECURE=True,
    SESSION_COOKIE_HTTPONLY=True,
    SESSION_COOKIE_SAMESITE='Lax',
)

Add Secure, HttpOnly and SameSite flags

Frameworks

Next.js

Express

Django

Laravel

Rails

Spring Boot

ASP.NET

Flask