It depends, HTTPOnly cookies are still accessible to JavaScript in some conditions, like those using an Android browser: https://www.owasp.org/index.php/HttpOn

It depends, HTTPOnly cookies are still accessible to JavaScript in some conditions, like those using an Android browser: https://www.owasp.org/index.php/HttpOnly#Browsers_Supporting_HttpOnly https://www.owasp.org/index.php/HttpOnly#Browsers_Supporting...