4 ms·
Normal cookies are JS-accessible, but HTTP-only cookies should not be: "A cookie with the HttpOnly attribute is inaccessible to the JavaScript Document.cookie A
by AlbinoDrought 6y ago
Normal cookies are JS-accessible, but HTTP-only cookies should not be: "A cookie with the HttpOnly attribute is inaccessible to the JavaScript Document.cookie API; it is sent only to the server."
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#re...
- leipert 6y agoAh thanks! This is new to me. That is indeed a concern, but probably can be worked around, e.g. by proxying requests to third party domains through the same Domain.
- kreetx 6y agoYou can't make the browser to send you cookies for other origins so you won't be able to use them from your server.