> Markdown version of [/videos/1859-things-you-don-t-know-about-cookies-and-how-to-protect-them-mohamed-shiralizadeh?t=3733](https://www.wearedevelopers.com/videos/1859-things-you-don-t-know-about-cookies-and-how-to-protect-them-mohamed-shiralizadeh?t=3733). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Things You Don't Know About Cookies and How to Protect Them - Mohamed Shiralizadeh

Mohamed Shiralizadeh reveals why unencrypted cookies make your applications prime targets for credential theft. Master strict HTTP attributes to lock down session management and defeat modern CSRF attacks.

- **Speakers:** Mohamed Shiralizadeh
- **Event:** Coffee With Developers
- **Published:** April 19, 2026
- **Duration:** 1:08:32
- **URL:** https://www.wearedevelopers.com/videos/1859-things-you-don-t-know-about-cookies-and-how-to-protect-them-mohamed-shiralizadeh

## Summary

Mohamed Shiralizadeh explores the mechanics and security implications of browser cookies, illustrating how they have evolved from simple state management tools to complex vectors for web vulnerabilities. Examining browser internals reveals that cookies are stored locally as SQLite databases, underscoring that unencrypted values—or basic Base64 encoding—make applications highly susceptible to session fixation or credential theft if a machine is compromised. Mitigating these risks requires not only robust encryption but also invalidating sessions on the server side to prevent hijacked cookies from remaining active.<br><br>The core defense against modern attacks lies in deeply understanding and configuring HTTP cookie attributes. Implementing the HttpOnly flag is mandatory to prevent cross-site scripting (XSS) attacks from stealing session data via JavaScript access. Furthermore, while setting the secure flag restricts transmission to HTTPS, developers must define the appropriate domain scope to prevent leaking sensitive credentials to unintended subdomains. Optimizing application performance is an additional factor; utilizing max-age takes precedence over traditional expires dates and significantly reduces HTTP payload overhead during every network request.<br><br>A comprehensive breakdown of the SameSite attribute highlights the shift toward stricter default browser behaviors to combat cross-site request forgery (CSRF). Setting SameSite to Lax has become the modern standard, allowing seamless top-level navigation while blocking unauthorized third-party requests, whereas Strict enforces absolute first-party isolation. Conversely, assigning None enables cross-site tracking and analytics but mandates a secure connection, directly tying into user-facing GDPR consent mechanisms. Ultimately, leaning on native browser cookie controls—rather than local storage—remains the most reliable strategy for handling authentication against increasingly sophisticated phishing and AI-driven supply chain attacks.

**Keywords:** browser cookie security, sqlite cookie storage, session fixation attacks, base64 encryption vulnerabilities, server-side session invalidation, httponly attribute implementation, cross-site scripting mitigation, samesite relaxed vs strict, cross-site request forgery prevention, max-age vs expires directives, secure cookie flag, cross-origin resource tracking, GDPR third-party consent, local storage authentication risks, top-level navigation isolation

## Chapters

1. **Understanding the lifecycle and fundamental mechanisms of browser cookies** (00:00) — Without built-in state mechanisms, applications utilize the set-cookie header to reliably store variables and seamlessly verify recurring user connections.
1. **Extracting stored cookie credentials from local sqlite databases** (05:36) — Physical installation access enables attackers to arbitrarily exfiltrate unencrypted session credentials via underlying browser database files.
1. **Securing cookie names and encrypting sensitive session values** (09:47) — Superficial encoding leaves data vulnerable, requiring robust encryption algorithms and secure name prefixes to protect sensitive session variables.
1. **Controlling cookie access across root domains and subdomains** (12:36) — Without explicit boundary configurations, managing the domain attribute actively safeguards systems by constraining access across various interconnected subdomains.
1. **Managing cookie lifespans and invalidating server-side sessions** (17:27) — While client-side time limits clear localized storage, backend session invalidation strictly neutralizes malicious attempts utilizing captured legacy cookies.
1. **Enforcing encrypted transmission with the secure cookie attribute** (20:09) — Permitting broad transmission exposes credentials, highlighting why the secure flag strictly enforces data transfer strictly over encrypted https protocols.
1. **Mitigating cross-site scripting risks using the httponly attribute** (24:10) — Unfettered frontend access enables widespread theft, forcing the httponly flag to reliably block automated javascript scraping techniques.
1. **Differentiating cross-origin requests from site boundaries for cookies** (28:54) — Distinguishing basic origins from actual site boundaries requires referencing the public suffix list to properly govern strict communication rules.
1. **Examining cross-site request vulnerabilities with samesite none** (34:12) — Disabling modern boundary restrictions recklessly exposes endpoints to targeted forgery while broadly facilitating unlimited third-party analytics tracking.
1. **Adopting samesite lax as the default browser security expectation** (38:56) — Mitigating the historical rise in deliberate request forgery relies entirely on modern browsers enforcing lax configurations as their baseline standard.
1. **Comparing samesite strict and lax for top-level navigations** (42:25) — Balancing stringent security with usability requires understanding how strict modes thoroughly block cookies while lax configurations safely accommodate authorized incoming links.
1. **Managing third-party tracking through browser privacy settings** (49:58) — Confronting invasive analytics engines requires directly blocking third-party interactions within native browser menus to override platform-level tracking integrations.
1. **Comparing local storage patterns with browser cookie security** (54:00) — Offloading proprietary sessions completely bypasses native web defenses, leaving unencrypted local storage arrays completely exposed to severe manipulation tactics.
1. **Identifying sophisticated supply chain attacks and simulated software vulnerabilities** (57:00) — Exploiting widespread developer trust allows threat actors to seamlessly distribute functional malicious toolkits using subtle open-source repository mistyping strategies.
1. **Prioritizing max-age over expires for http response optimization** (62:13) — Minimizing unnecessary network latency involves prioritizing compact max-age integers to significantly reduce request header payload bloat during high-volume operations.

## Related Moments

- [Applying transport restrictions and cookie security flags](https://www.wearedevelopers.com/videos/80-a-primer-in-single-page-application-security-angular-react-vue-js) (from "A Primer in Single Page Application Security (Angular, React, Vue.js)")
- [Blocking browser cookie theft and dangerous terminal commands](https://www.wearedevelopers.com/videos/1828-securing-ai-agents-from-the-ground-up-luke-hinds) (from "Securing AI Agents from the Ground Up - Luke Hinds")
- [Fixing cryptographic failures by enforcing encrypted transport](https://www.wearedevelopers.com/videos/100072-bulletproof-web-applications-the-2025-owasp-top-ten) (from "Bulletproof Web Applications: The 2025 OWASP Top Ten")
- [Securing applications with HTTP response headers](https://www.wearedevelopers.com/videos/724-security-in-modern-web-applications-owasp-to-the-rescue) (from "Security in modern Web Applications - OWASP to the rescue!")
- [Security defaults and preventing cross site request forgery](https://www.wearedevelopers.com/videos/112-is-django-too-complicated) (from "Is Django too Complicated?")
- [Navigating malicious compliance in GDPR cookie banner implementations](https://www.wearedevelopers.com/videos/1753-wearedevelopers-live-spicy-vanilla-web-css-magic-more) (from "WeAreDevelopers LIVE – Spicy Vanilla Web, CSS Magic & More")

## Related Articles

- [What are Cookies and Why Do We Use Them?](https://www.wearedevelopers.com/magazine/729-what-are-cookies-and-why-do-we-use-them)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [11 Best Practices For PHP Security](https://www.wearedevelopers.com/magazine/90-11-best-practices-for-php-security)
- [Dev Digest 139 - Soft and hard queries](https://www.wearedevelopers.com/magazine/487-dev-digest-139-soft-and-hard-queries)

## Related Jobs

- [Security Architect - AI](https://www.wearedevelopers.com/jobs/ext/1581899-security-architect-ai) at **ZEISS Group**
- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [Principal Software Engineer, Identity](https://www.wearedevelopers.com/jobs/ext/1469181-principal-software-engineer-identity) at **GitHub**
- [Software Engineer II, Security](https://www.wearedevelopers.com/jobs/ext/131510-software-engineer-ii-security) at **GitHub**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Endpoint Security Engineer - OT](https://www.wearedevelopers.com/jobs/ext/1306782-endpoint-security-engineer-ot) at **ZEISS Group**