CORS is not a firewall, SameSite is not a complete CSRF defence, and a token in localStorage is not safer than a cookie, just exposed differently. What each browser mechanism does and does not do, and the cookie settings we would start with.
Most browser security mechanisms protect users from other websites, not your server from attackers. The server still has to check who is asking, and whether they may, on every request.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
A token in localStorage is readable by any script on the page, so one cross-site scripting bug leaks it and it works from anywhere. An HttpOnly cookie cannot be read by script, but the browser sends it automatically, which is why cookies need CSRF protection. For a web app on its own domain, an HttpOnly cookie with SameSite and an Origin check is the common choice. Native apps usually keep tokens in the platform's secure storage instead.
Set HttpOnly, Secure and SameSite=Lax explicitly. Some browsers default to Lax when SameSite is missing, not all do, and that default lets POSTs through for two minutes after the cookie is set.
Name the session cookie with the __Host- prefix. Browsers then require Secure, Path=/ and no Domain attribute, so a subdomain cannot set or overwrite it.
Use SameSite=None only for cookies that must work cross-site, such as embeds. It requires Secure.
Keep session lifetimes finite and let users sign out other devices.
If the frontend and API share an origin, for example the API under /api behind the same CDN, you need no CORS at all.
Otherwise, allow the exact origins you serve. Do not echo back whatever Origin the request sends.
Browsers reject a wildcard (*) on requests with credentials.
Custom headers or JSON bodies trigger a preflight OPTIONS request. Answer it, and cache it with Access-Control-Max-Age.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Your App Has Users Now: The Internet Underneath It, on One Page
Building fast skips the parts of the internet that only matter once people depend on you: DNS, certificates, email authentication, caching, timeouts, backups and abuse. What happens between someone typing your domain and your database answering, what breaks at each step, and the order we would fix things in.
Read
DNS for App Builders: Records, TTLs, the Apex Problem, and Why "Propagation" Is Caching
What each DNS record does, why you cannot put a CNAME on your bare domain, why DNS changes seem to take hours, and how to stop the domain itself becoming your single point of failure. With Route 53 prices and the January 2025 switch from WHOIS to RDAP.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.