HttpOnly
A cookie security attribute that, when set, prevents JavaScript from accessing the cookie. It is used to mitigate the theft of session tokens through XSS attacks.
Timeline (last 90 days)
Combined with Cookie attributes such as HttpOnly, Secure, and SameSite, this can further reduce the risk of tokens being stolen via XSS or leaked across sites.
Session tokens usually exist in the form of a Session ID in a Cookie or a JWT, and subsequent requests use them to identify the user; if the Cookie is not set with HttpOnly, XSS scripts can read it directly; if not set with Secure, the token may leak over plaintext HTTP; if not set with SameSite, it is vulnerable to CSRF attacks.
HttpOnly cookies can prevent JavaScript from reading session tokens, and are an effective measure against XSS session theft.
All Facts (3)
Combined with Cookie attributes such as HttpOnly, Secure, and SameSite, this can further reduce the risk of tokens being stolen via XSS or leaked across sites.
50%UnverifiedSession tokens usually exist in the form of a Session ID in a Cookie or a JWT, and subsequent requests use them to identify the user; if the Cookie is not set with HttpOnly, XSS scripts can read it directly; if not set with Secure, the token may leak over plaintext HTTP; if not set with SameSite, it is vulnerable to CSRF attacks.
50%UnverifiedHttpOnly cookies can prevent JavaScript from reading session tokens, and are an effective measure against XSS session theft.
50%