httpOnly cookie
An httpOnly cookie is a special cookie set by the server that is marked with the HttpOnly flag to prevent access by JavaScript. It is used to store sensitive information such as refresh tokens and provides effective defense against XSS attacks.
Timeline (last 90 days)
An httpOnly cookie is written by the server via the HttpOnly flag in the Set-Cookie response header; no JavaScript (including document.cookie and Fetch/XHR) can read or modify it, and it can only be automatically carried by the browser on matching requests.
The guide recommends using an httpOnly cookie to carry the refresh token, with the frontend holding only a short-lived access token, and validating every request on the Node API side.
All Facts (2)
An httpOnly cookie is written by the server via the HttpOnly flag in the Set-Cookie response header; no JavaScript (including document.cookie and Fetch/XHR) can read or modify it, and it can only be automatically carried by the browser on matching requests.
50%UnverifiedThe guide recommends using an httpOnly cookie to carry the refresh token, with the frontend holding only a short-lived access token, and validating every request on the Node API side.
50%