Cookie dan sesi for Google Tag Manager
high5 checks
Session cookies are the keys to an account. Missing attributes turn a single XSS bug into full account takeover.
What Google Tag Manager must have
- Secure attribute on every cookie
- HttpOnly on session cookies
- SameSite=Lax or Strict on session cookies
- No session identifier in URLs or localStorage
- Session rotation after login and logout invalidation
How to fix it
- 1Set cookie attributes at the framework level so every cookie inherits them
- 2Move tokens out of localStorage to HttpOnly cookies
Google Tag Manager context
Tag injection container for marketing and analytics scripts.
Anyone with GTM publish rights can inject scripts on every page — a supply-chain trust decision.