From Dev.to
A renamed cookie and a logout button that did nothing
After the first review I renamed the session cookie to __Host-session. The prefix makes the browser accept the cookie only over HTTPS, with no domain attribute and with the path set to the root, which...