Which cookies settings help protect session data?

• A. HttpOnly and Secure cookies
• B. HttpOnly disabled
• C. TLS enforcement only
• D. Reusing session IDs

Answer: (A)

Protecting session data stored in cookies requires both restricting who can read the cookie in the browser and ensuring the cookie is only sent over secure channels. HttpOnly prevents client-side scripts from reading the cookie, which blocks many cross-site scripting attack methods from stealing session identifiers. Secure ensures the cookie is transmitted only over HTTPS, so it is not sent in plaintext over unencrypted connections. Together, these flags reduce the risk of session hijacking from both script-based access and network eavesdropping.

Relying on TLS enforcement alone doesn't stop scripts from accessing cookies, and cookies without the Secure flag can be exposed over HTTP. Reusing session IDs is a vulnerability that undermines session integrity and isn’t a protective cookie setting. That combination of HttpOnly and Secure cookies best protects session data.