Data between client and server must be encrypted.
HTTPS:
- Encrypts all traffic
- Prevents man-in-the-middle attacks
- Required for modern browser features
HSTS (HTTP Strict Transport Security):
Strict-Transport-Security: max-age=31536000; includeSubDomains
Forces HTTPS. Browser refuses HTTP connections.
Secure cookies:
Set-Cookie: token=abc; Secure; HttpOnly; SameSite=Strict
Secure flag ensures cookie only sent over HTTPS.