HttpOnly cookie
HttpOnly prevents direct cookie access by page scripts. Matching requests can still carry the cookie; session and permission checks remain necessary.
Shield the cookie value from page scripts
A cookie with the HttpOnly attribute is not accessible to page scripts through document.cookie. The server sets the attribute in the Set-Cookie response header. For a session identifier, this limits reading its value through injected JavaScript. It does not prevent that script from executing.
Separate the session identifier from display data
A fictional project portal stores its session identifier in the sessionId cookie. The interface only needs the display name for its greeting. After server-side session and permission checks, the proposed profile request returns displayName; the frontend does not need to read the session identifier for this.
The browser can still automatically attach an HttpOnly cookie to matching requests, including those initiated with fetch(). Other cookie conditions still apply. An injected script could therefore sometimes perform actions within the signed-in session without knowing the cookie value. XSS and CSRF protection and server-side permission checks remain necessary.
The separate Secure attribute restricts transmission to HTTPS; SameSite affects inclusion in cross-site requests. These properties have different jobs.
Sources
Related terms
- SameSite cookieSameSite affects cookie inclusion in cross-site requests. The choice must fit login and navigation flows; CSRF protection remains necessary.
- Cross-site scripting (XSS)In XSS, external content becomes executable code in the browser. The key issue is how an application inserts input into its pages.
- Cross-site request forgery (CSRF)CSRF exploits a signed-in session for an unwanted request. A session cookie alone does not prove that the user intended the action.
- Data minimisationData minimisation limits personal data to what is adequate, relevant and necessary for a defined purpose.
- Data retention policyA data retention policy defines the purpose, start, duration and end of storage. Deletion jobs and copies must be addressed in the implementation.
- Envelope encryptionEnvelope encryption separates the data key from the key protecting it. The encrypted file and wrapped data key need to be managed together.
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.