Published onNovember 4, 2026Don't Put the Username in the CookiecookiessessionssecurityexpressA login cookie that trusts the browser, fixed one layer at a time: HttpOnly, Secure, signing, server-side sessions and SameSite, and what each layer still leaves open.