httponly

Module for Nginx which allows to set the flags "HttpOnly", "secure" and "SameSite" for cookies.

Passwordless Authentication of User in Node(express) and React using JWT and Twilio SMS API without and any database for validating OTP

Making a JS SPA with a non-JS Backend taking advantage of httpOnly Cookies

🦊 FARM stack (FastAPI, React, Mongo DB)

Working example of httpOnly cookies and custom routing in R Shiny — supports the ShinyConf 2024 talk

Demonstrating exploitation of missing HTTP cookie flags

🔐 JWT Auth system using Access + Refresh Tokens with blacklist support on logout. Includes protected routes, httpOnly cookies, and token refresh logic using MongoDB and Express.

Implementing the Antiforgery feature of an ASP.NET Core Web API project using a 100% with HttpOnly Cookies.

my MERN stack auth boilerplate

Lint Set-Cookie headers for security locally — missing HttpOnly/Secure/SameSite, SameSite=None without Secure, over-broad Domain, and __Host-/__Secure- prefix violations that make browsers silently drop your cookie. Deterministic CLI, JSON/MD reports.

Secure JWT authentication for React and Next.js — HttpOnly server sessions, verified tokens, CSRF built in

Spring Boot with Spring Security, JWT (auth0/java-jwt or jjwt), HttpOnly Cookie and Vue.js

Audit Set-Cookie headers for Secure, HttpOnly, SameSite, prefixes, expiry, domain, and third-party cookie issues.

httpOnly cookie based authentication with next.js API route

Secure backend API for bookmark manager with links, tags, categories, favorites, and user ownership using Node.js, Express, MongoDB, JWT, and HttpOnly cookies.

Secure backend authentication API implementing access token and refresh token flow with HttpOnly cookies using Node.js, Express, and MongoDB.

Backend API for newsletter subscribe, unsubscribe, and subscriber listing using Node.js, Express, MongoDB, JWT authentication, and HttpOnly cookies.

Open-source cookie manager for Chrome (Manifest V3). View, edit & delete cookies including HttpOnly, CHIPS partition inspector, export to Playwright/Puppeteer. No "tabs" permission, no telemetry, no remote code.