HttpOnlyCookies

HttpOnly cookies are cookies that include the HttpOnly attribute. When a cookie is marked HttpOnly, the browser is instructed not to expose that cookie to client-side scripts such as JavaScript running in the page. This helps prevent theft or tampering of the cookie via cross-site scripting (XSS) attacks. The cookie will still be sent to the server with each request to the cookie's domain and path.

The attribute is set by the server in the Set-Cookie header, for example: Set-Cookie: sessionId=abc123; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=3600. In practice, the browser stores the cookie and includes it in HTTP requests, but client-side scripts cannot read or modify it via document.cookie.

HttpOnly does not protect against all cookie abuse. It does not prevent cross-site request forgery (CSRF) by itself, so SameSite or anti-CSRF tokens are recommended. It also does not guard against server-side vulnerabilities or physical access to a user's device. The cookie's value is not encrypted by virtue of HttpOnly; using Secure and TLS is important to protect in transit. HttpOnly doesn't stop leaks through browser extensions, malware, or misconfigurations.

HttpOnly is widely supported in modern browsers. For session cookies, combine HttpOnly with Secure and SameSite attributes, and store only non-sensitive data where appropriate. Use proper server-side defenses and encryption for sensitive information.