Design flaw would be if the specification implied that manipulation of cookies through non-HTTP APIs could affect the HttpOnly cookies. But it only says: "the a

Design flaw would be if the specification implied that manipulation of cookies through non-HTTP APIs could affect the HttpOnly cookies. But it only says: "the attribute instructs the user agent to omit the cookie when providing access to cookies via "non-HTTP" APIs". So, the browsers really should "omit" it, that is, not affect it directly by scripted manipulation of cookies in any way. Yes, "omit the cookie" feels a little vague, but I'm also not sure that the specification authors should be blamed for this wording. https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.2.6 https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.2....