3 ms·
Httponly cookies are still added automatically to js initiated requests. It is not a legacy feature. You don't need to get it another way because you don't need
by ndriscoll 2y ago
Httponly cookies are still added automatically to js initiated requests. It is not a legacy feature. You don't need to get it another way because you don't need to get it at all in js. It prevents XSS from stealing the cookie and sending it elsewhere (though a successful XSS could still use the cookie while the user is on the page).
- hu3 2y agoThank you. It's impressive how much misinformation there is in our field. Some people read 1 paragraph from documentation and assume Httponly cookies are useless for SPAs.