Session tokens use secure, HttpOnly, SameSite cookies

Session cookies without the Secure, HttpOnly, and SameSite flags are the most common entry point for session hijacking. Dropping HttpOnly makes the cookie readable by any JavaScript on your page — a single XSS flaw anywhere on the domain hands an attacker every active session. Dropping Secure lets the cookie travel over unencrypted HTTP connections, where network attackers can intercept it. Missing SameSite exposes the session to CSRF attacks. Together these flags implement the three-sided defense OWASP A07 (Identification & Authentication Failures) and NIST 800-63B expect as a baseline for any session credential.

Set all three flags explicitly in your auth library config rather than relying on defaults. In NextAuth, override the cookie options block:

// src/app/api/auth/[...nextauth]/route.ts
export const authOptions = {
  cookies: {
    sessionToken: {
      options: {
        httpOnly: true,
        secure: process.env.NODE_ENV === 'production',
        sameSite: 'lax',
        path: '/'
      }
    }
  }
}

For Supabase, use @supabase/ssr — it handles all three flags correctly. For any custom Set-Cookie header, append ; HttpOnly; Secure; SameSite=Lax before every response.