HttpOnly Cookie Attribute

Prevents client-side JavaScript from reading a cookie through document.cookie.

Use `HttpOnly` for cookies that do not need to be read by browser JavaScript, especially session cookies.

cookiessecurityxsssessions

Session cookie (http)

Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax; Path=/

HttpOnly reduces the ability of an injected script to steal a session cookie. It does not prevent the browser from sending the cookie with requests, and it does not stop XSS itself.

CSRF defenses, SameSite settings, and origin checks are still needed when cookie authentication is used.

Common mistakes

Reading the session cookie in frontend code when a server endpoint could expose the needed session state safely.
Treating HttpOnly as a complete XSS defense.

Secure Cookie Attribute SameSite Cookie Attribute Content-Security-Policy (CSP)

Sources

MDN Web Docs: HTTP