Server-side session · httpOnly · secure