An HttpOnly cookie is a cookie set with the HttpOnly attribute. The browser still sends it with matching requests, but scripts running in the page cannot access it through document.cookie.
Why it matters
If an attacker finds a cross-site scripting flaw, injected script could otherwise read the session cookie and send it away. HttpOnly removes that easy route, so the attacker cannot simply copy the session identifier. It does not stop XSS itself, since injected script can still act as the user while the page is open, but it reduces the damage.
Example
Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=LaxIn the browser console, document.cookie will not list session, yet the cookie accompanies every request to the site.
Common mistakes
- Setting HttpOnly on a cookie that front-end code legitimately needs to read, then working around the break instead of redesigning.
- Forgetting it on session and authentication cookies.
- Believing it replaces output encoding and a Content Security Policy.
- Storing tokens in
localStorage, which scripts can always read.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.