Which security headers and cookie settings matter for a browser-facing API?

Use security headers, TLS, and cookie flags correctly

Explains HTTPS, HSTS, secure cookies, HttpOnly, SameSite, no-store, and practical API/browser security hardening.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

A browser-facing API should use HTTPS and set cookies with Secure so they are not sent over HTTP. Auth cookies should usually be HttpOnly to reduce token theft through JavaScript and SameSite based on the required cross-site behavior. Sensitive responses should use no-store caching headers where appropriate so private data is not cached by browsers or intermediaries.

Full answer below

Practice focus

TLS, HSTS, Secure, HttpOnly, SameSite, Cache-Control, CSP basics, X-Content-Type-Options, and environment configuration.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Headers and cookie flags are not the whole security model, but missing basics can undermine otherwise good authentication.
A browser-facing API should use HTTPS and set cookies with Secure so they are not sent over HTTP. Auth cookies should usually be HttpOnly to reduce token theft through JavaScript and SameSite based on the required cross-site behavior. Sensitive responses should use no-store caching headers where appropriate so private data is not cached by browsers or intermediaries.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I would also consider HSTS so browsers keep using HTTPS, , and a Content Security Policy for pages served by the app. CSP is more relevant to HTML pages than pure JSON APIs, but it matters if the same app serves frontend content. The exact settings need to match the deployment domains, proxies, TLS termination, and whether cookies cross subdomains or sites.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Sending auth cookies without Secure.
Using JavaScript-readable cookies for refresh tokens without need.
Caching private auth responses.
Configuring headers only locally and not verifying through the real proxy.

Which security headers and cookie settings matter for a browser-facing API?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue practice

Try a variant

Tech stacks

Skill areas

Suggest an improvement