Cookie dan sesi for Ghost
high5 checks
Session cookies are the keys to an account. Missing attributes turn a single XSS bug into full account takeover.
What Ghost must have
- Secure attribute on every cookie
- HttpOnly on session cookies
- SameSite=Lax or Strict on session cookies
- No session identifier in URLs or localStorage
- Session rotation after login and logout invalidation
How to fix it
- 1Set cookie attributes at the framework level so every cookie inherits them
- 2Move tokens out of localStorage to HttpOnly cookies
Ghost context
Node.js publishing platform for blogs and newsletters.
Keep the version current and never expose the Ghost admin API secret in the theme.