We can ignore Cookies danger by just not recommending its usage, but the fact is that <a target="_blank" href="https://w3techs.com/technologies/details/ta-googleanalytics#:~:text=google%20analytics%20is%20used%20by%2084.8%25%20of%20all%20the%20websites%20whose%20traffic%20analysis%20tool%20we%20know.%20this%20is%2055.2%25%20of%20all%20websites.">at least 55% of all the websites</a> use Cookies RIGHT NOW even with lots of existing cookieless strategies.
So how to protect Cookies against Common XSS Attacks?
Well, if your app really needs to use Cookies, configure each one through <a target="_blank" href="https://developer.mozilla.org/pt-BR/docs/Web/HTTP/Headers/Set-Cookie">Set-Cookie HTTP Header</a> with at least the following flags:
🍪 <code>Secure</code>: To allow the Cookie only through HTTPS
🍪 <code>HttpOnly</code>: To remove the Cookie from the <a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie">document.cookie</a>
🍪 <code>SameSite</code>: To limit the Cookie context usage
<pre><code class="lang-javascript">Set-Cookie: Secure;HttpOnly;SameSite=Strict;...
</code></pre>
Hope that with these tips, your app now has a few more chances against XSS Attackers that use Cookies breaches. Anyway, keep in mind that complex attacks can easily bypass these tips. So try to migrate ASAP to cookieless strategies.

We can ignore Cookies danger by just not recommending its usage, but the fact is that [at least 55% of all the websites](https://w3techs.com/technologies/details/ta-googleanalytics#:~:text=google%20analytics%20is%20used%20by%2084.8%25%20of%20all%20the%20websites%20whose%20traffic%20analysis%20tool%20we%20know.%20this%20is%2055.2%25%20of%20all%20websites.) use Cookies RIGHT NOW even with lots of existing cookieless strategies.

So how to protect Cookies against Common XSS Attacks?

Well, if your app really needs to use Cookies, configure each one through [Set-Cookie HTTP Header](https://developer.mozilla.org/pt-BR/docs/Web/HTTP/Headers/Set-Cookie) with at least the following flags:

🍪 `Secure`: To allow the Cookie only through HTTPS

🍪 `HttpOnly`: To remove the Cookie from the [document.cookie](https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie)

🍪 `SameSite`: To limit the Cookie context usage

```javascript
Set-Cookie: Secure;HttpOnly;SameSite=Strict;...
```

Hope that with these tips, your app now has a few more chances against XSS Attackers that use Cookies breaches. Anyway, keep in mind that complex attacks can easily bypass these tips. So try to migrate ASAP to cookieless strategies.

Brief content about how to avoid bad configured Cookies to protect your web applications against XSS Attacks

How to Protect Cookies Against Common XSS Attacks on the Web?