Unverified50% confidenceFactExact time
An httpOnly cookie is written by the server via the HttpOnly flag in the Set-Cookie response header; no JavaScript (including document.cookie and Fetch/XHR) can read or modify it, and it can only be automatically carried by the browser on matching requests.
1
Sources
50%
Confidence
Long-term
Relevance
10/12/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedStoring JWT in HTTP-only cookies prevents client-side JavaScript from reading the token, thereby defending against XSS attacks that steal authentication credentials.78% similarUnverifiedCookie通常设置HttpOnly标志，使JavaScript无法直接读取，以防范跨站脚本（XSS）攻击77% similarUnverifiedHTTP Cookie 机制在 1994 年被发明时完全没有考虑安全性，document.cookie API 允许任何页面脚本读取所有非 HttpOnly 的 Cookie76% similarUnverifiedVaultisse uses JWT stored in HTTP-only cookies for authentication.71% similarUnverifiedWeb端遵循RFC 6265标准Cookie规范，身份状态以HttpOnly、Secure标记的会话Cookie存储在浏览器沙箱中，不涉及设备级API调用69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1009804API
curl https://kongchang.com/api/v1/knowledge/claims/1009804MCP
get_claim(id=1009804)