Cookie dan sesi for Sentry
high5 checks
Session cookies are the keys to an account. Missing attributes turn a single XSS bug into full account takeover.
What Sentry must have
- Secure attribute on every cookie
- HttpOnly on session cookies
- SameSite=Lax or Strict on session cookies
- No session identifier in URLs or localStorage
- Session rotation after login and logout invalidation
How to fix it
- 1Set cookie attributes at the framework level so every cookie inherits them
- 2Move tokens out of localStorage to HttpOnly cookies
Sentry context
Error monitoring and performance tracing SDK.
DSNs are public by design, but ensure PII scrubbing and that source maps are not publicly reachable.