HttpOnly Cookie

An HttpOnly cookie is a cookie set with the HttpOnly attribute. The browser still sends it with matching requests, but scripts running in the page cannot access it through document.cookie.

Why it matters

If an attacker finds a cross-site scripting flaw, injected script could otherwise read the session cookie and send it away. HttpOnly removes that easy route, so the attacker cannot simply copy the session identifier. It does not stop XSS itself, since injected script can still act as the user while the page is open, but it reduces the damage.

Example

Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=Lax

In the browser console, document.cookie will not list session, yet the cookie accompanies every request to the site.

Common mistakes

• Setting HttpOnly on a cookie that front-end code legitimately needs to read, then working around the break instead of redesigning.
• Forgetting it on session and authentication cookies.
• Believing it replaces output encoding and a Content Security Policy.
• Storing tokens in localStorage, which scripts can always read.

Related

• Cookie
• XSS
• Secure cookie flag
• SameSite cookie attribute
• टूल: Cookie checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.