3 ms·

The author glosses over this but what they mean is that you can set the HttpOnly flag on cookies to prevent them from being accessed via JavaScript.

• akarambir 8y ago
  But is it still sent automatically on ajax requests by browsers?
  • SahAssar 8y ago
    Yes.