Audit cookie flags with a six-point checklist

Introduction

A practical checklist for reviewing every Set-Cookie in your app: scope, lifetime, prefixes, and cross-site behavior. It also includes a short script that flags risky cookies during CI.

Field notes

A few patterns we kept seeing while puttering around Cybersecurity problems:

• The simple version survived every refactor; the clever version didn’t.
• Documentation written during the work aged far better than documentation written after.
• The second time a problem shows up, it is already a pattern — name it.

A checklist you can steal

• The failure is reproducible with one command.
• The fix has a test that fails without it.
• Someone other than the author has run it on their machine.

Closing

Write the short version future-you will actually read. That is the whole trick.