.tip

Jun 23, 2026 · one of the small things

Read the code first, then the tests, as claims

Reading a test first primes you to accept the code it describes. Read the code, decide what you think it does, then open the tests and check whether they agree with you rather than with the code. When the author of both is the same agent, a green suite is the floor, not evidence.

code-reviewtesting

Longer version: the post this came from.

~/tips/today — 2026-09-04

~cat tips/today

Session cookies: HttpOnly, Secure, SameSite=Lax

securityhttp

Three attributes, each closing a class of attack. HttpOnly keeps scripts from reading it. Secure keeps it off plain HTTP. SameSite=Lax stops it being sent on cross-site POSTs, which is most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while logged in. Lax is the default worth keeping.

↵ open y yesterday l ls /tips

esc close