Sessions hostile scripts can’t read.
Browser-session authentication with sensitive-key protection and origin restriction, so the session cookie is hardened against theft and cross-site reuse and kept out of JavaScript’s reach.
1. The session cookie is the prize
The usual goal of an XSS or CSRF attack is the session: steal the cookie and you are the user. Hardening the session cookie therefore pays for itself across whole classes of attack. The controls are well established — mark it HttpOnly so script cannot read it, Secure so it never crosses plaintext, and SameSite so it is not replayed cross-site — but they must be the default, not a per-app afterthought.
2. Beyond the flags
AuthCookie adds origin restriction and sensitive-key protection on top of the standard flags, binding the session to where it should be used and protecting the material that would let it be forged. A stolen cookie that authenticates only from the right origin is far less useful to an attacker than a portable one.
3. How B5 Secure handles it
B5 Secure’s AuthCookie scheme hardens browser sessions by default — out of JavaScript’s reach, origin-restricted, and protected against theft and cross-site reuse — and runs through the same verification pipeline as machine schemes, so browsers and services are held to one consistent bar.