HttpOnly cookie
Also called: HttpOnly, Secure flag
A cookie flag that hides the cookie from page JavaScript, protecting session IDs if the page is attacked.
Definition
Session cookies should be HttpOnly, Secure (HTTPS only) and have a SameSite setting. Testers check these flags in the DevTools cookie table.
In practice
The session_id cookie has no tick in the HttpOnly column, so any injected script could read it.
Related terms
- CookieA small piece of data a website stores in your browser, for example to keep you logged in.
- SessionThe period during which a user stays logged in without entering their credentials again.
- SameSiteA cookie setting (Strict, Lax or None) that controls whether a cookie is sent on requests from other sites.