@SessionAttributes and @CookieValue both move state outside a single request, which introduces security concerns around what data gets stored there and how it can be tampered with or intercepted.
Key Points: • @SessionAttributes keeps model attributes in the HTTP session across requests, so sensitive data placed there persists in server memory and possibly gets serialized if sessions are clustered. • Avoid storing passwords, tokens, or other sensitive values via @SessionAttributes — session data can be exposed through session fixation or improper invalidation on logout. • @CookieValue reads values sent by the client, which means the value is fully attacker-controlled and must be validated, never trusted blindly. • Cookies used for session or auth data should set HttpOnly, Secure, and SameSite attributes to reduce XSS and CSRF exposure. • Sessions should be explicitly invalidated on logout and regenerated on privilege changes to prevent session fixation attacks.
Example: Storing a user's cart contents with @SessionAttributes is reasonable, but storing an authentication flag there instead of relying on Spring Security's session management would create an easy target for session fixation or tampering.
Interview Tip: A concise interview answer is:
"With @SessionAttributes I'm careful not to store sensitive data in the session unnecessarily, and I make sure sessions are invalidated on logout to prevent fixation attacks. With @CookieValue I treat the value as untrusted client input, validate it, and rely on HttpOnly, Secure, and SameSite flags on any cookie carrying sensitive state."