Httponly Memes

Someone just pushed a cookie named "kkk" to production with httpOnly and secure flags. One dev has the sudden realization that maybe, just maybe , naming your cookies after hate groups isn't the best look before launch. The other dev? Zero concerns. "Users never see cookie names" is technically true, but that's the kind of energy that leads to variables like "temp_n****r_array" sitting in your codebase until some poor intern discovers it during an audit. Sure, cookie names are hidden from end users, but your browser dev tools, security researchers, and that one nosy developer at the company acquiring you will absolutely see it. Nothing says "professional engineering team" like explaining why your auth cookies sound like a Klan rally.