.tip

Apr 29, 2026 · one of the small things

paths filters keep a docs change from running the full suite

A typo fix in the README does not need the integration tests.

on:
  pull_request:
    paths-ignore:
      - "**.md"
      - "docs/**"

Careful with required checks: a workflow that does not run reports nothing, and branch protection treats that as missing. Either make the check conditional inside the job or keep it out of the required list.

~/tips/today — 2026-09-04

~cat tips/today

Session cookies: HttpOnly, Secure, SameSite=Lax

securityhttp

Three attributes, each closing a class of attack. HttpOnly keeps scripts from reading it. Secure keeps it off plain HTTP. SameSite=Lax stops it being sent on cross-site POSTs, which is most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while logged in. Lax is the default worth keeping.

↵ open y yesterday l ls /tips

esc close