httponly

Module for Nginx which allows to set the flags "HttpOnly", "secure" and "SameSite" for cookies.

Passwordless Authentication of User in Node(express) and React using JWT and Twilio SMS API without and any database for validating OTP

Making a JS SPA with a non-JS Backend taking advantage of httpOnly Cookies

🦊 FARM stack (FastAPI, React, Mongo DB)

Working example of httpOnly cookies and custom routing in R Shiny — supports the ShinyConf 2024 talk

Demonstrating exploitation of missing HTTP cookie flags

🔐 JWT Auth system using Access + Refresh Tokens with blacklist support on logout. Includes protected routes, httpOnly cookies, and token refresh logic using MongoDB and Express.

Implementing the Antiforgery feature of an ASP.NET Core Web API project using a 100% with HttpOnly Cookies.

my MERN stack auth boilerplate

Lint Set-Cookie headers for security locally — missing HttpOnly/Secure/SameSite, SameSite=None without Secure, over-broad Domain, and __Host-/__Secure- prefix violations that make browsers silently drop your cookie. Deterministic CLI, JSON/MD reports.

Secure JWT authentication for React and Next.js — HttpOnly server sessions, verified tokens, CSRF built in

Spring Boot with Spring Security, JWT (auth0/java-jwt or jjwt), HttpOnly Cookie and Vue.js

Audit Set-Cookie headers for Secure, HttpOnly, SameSite, prefixes, expiry, domain, and third-party cookie issues.

httpOnly cookie based authentication with next.js API route

Secure backend API for a personal bookmark manager with JWT authentication, HttpOnly cookies, user-owned bookmarks, tags, categories, and favorites using Node.js, Express, and MongoDB.

A TypeScript-first API client focused on secure browser auth: coalesced token refresh, Web Worker token isolation, and cross-tab session sync. Zero runtime dependencies, works in every JS runtime.

Secure backend API for task manager CRUD with status, priority, due date, and user ownership using Node.js, Express, MongoDB, JWT, and HttpOnly cookies.

Check, visualize, and understand how browsers handle your cookies.