HttpOnly
A cookie attribute that stops scripts in the page from reading the cookie through document.cookie (RFC 6265); a sensitive cookie without it is CWE-1004. It limits theft of session cookies through XSS but not their misuse: injected script can still send requests that carry the cookie.
- Fix it in your stack
- Session fixation and session cookies fix cards (6 stacks) · CWE-1004 page
- Defined in
- RFC 6265
- Identifiers
- CWE-1004: Cookie without HttpOnly flag
Covered in
Session management: cookies, timeouts, rotation and revocation
Model authentication as transitions in server authority, set session cookies and timeouts to current NIST and OWASP values, and verify fixation prevention, expiry, reauthentication, revocation and stolen-cookie defenses.
Configure HTTP security headers from a tested baseline
Send the response headers that make browsers enforce HTTPS, run only your own scripts, refuse hostile framing and keep cookies on one host, then prove they appear on every kind of response.
Practice: CSP builder lab: Build a strict Content-Security-Policy