The three flags on a session cookie

• A

  A cross-site request that rides the user’s existing session

• B

  An attacker on the network reading the cookie in transit

• C

  A malicious site setting a cookie for your domain

• D

  Script on the page reading the cookie and sending it elsewhere