2 ms·
HttpOnly is mostly a vestigial artifact of the 2000s. As soon as web apps began relying on JS in the browser making calls to APIs, that same JS started needing
by blincoln 2y ago
HttpOnly is mostly a vestigial artifact of the 2000s.
As soon as web apps began relying on JS in the browser making calls to APIs, that same JS started needing access to the session token, or credentials equivalent to the session token.
If you maintain an app that can get away with an HttpOnly session token cookie, it's a good idea, but unless it's legacy code, it will probably break something, or the JS is getting creds another way and the cookie having the flag set is giving you a false sense of security.
- ndriscoll 2y agoHttponly cookies are still added automatically to js initiated requests. It is not a legacy feature. You don't need to get it another way because you don't need to get it at all in js. It prevents XSS from stealing the cookie and sending it elsewhere (though a successful XSS could still use the cookie while the user is on the page).
- hu3 2y agoThank you. It's impressive how much misinformation there is in our field. Some people read 1 paragraph from documentation and assume Httponly cookies are useless for SPAs.