HttpOnly cookie

What it means

HttpOnly is a flag a server puts on a cookie to tell the browser that page scripts must not read it. The cookie is still sent with requests to your server. It simply does not appear in document.cookie, so JavaScript on the page cannot see or copy it.

The flag exists for one reason. If an attacker gets a script running on your page, the session cookie is the first thing they want. HttpOnly takes that easy prize off the table, which is why OWASP calls it a basic protection for session cookies.

Why it matters

A stolen session cookie lets someone act as the user without any password. With a cookie that scripts cannot read, an XSS flaw becomes harder to turn into session hijacking: the attacker cannot simply send the cookie value to their own server.

It is a cheap safeguard that is often missing on the one cookie that matters. It is also frequently set on the wrong cookie, protecting a harmless preference while the real session token stays readable. That gap shows in a security review as a quick, avoidable finding.

How it shows up

Frameworks usually set HttpOnly on the session cookie by default; custom cookies and tokens set by your own code do not always. A token stored in localStorage is always readable by script. Check the Set-Cookie header on login for HttpOnly, Secure and SameSite together.

The flag has limits that teams forget. A script running in the page can still make requests, and the browser attaches the cookie, so an attacker can act as the user from inside the page without ever seeing the value. HttpOnly narrows XSS damage and does not remove XSS. Fix the flaw too.