What is an HttpOnly Cookie?
An HttpOnly cookie is a cookie with the HttpOnly attribute set, which blocks client-side JavaScript from reading or modifying it through document.cookie. It can only be sent by the browser automatically with HTTP(S) requests, making it the primary defense against session-cookie theft via Cross-Site Scripting (XSS) attacks.
Why does HttpOnly matter?
What is HttpOnly Cookie
Without the HttpOnly flag, any JavaScript running on your page — including malicious scripts injected through an XSS vulnerability — can read cookies directly:
document.cookie // returns session tokens, auth cookies, everything readable
If an attacker manages to inject a script into your site (through an unescaped form field, a vulnerable third-party widget, etc.), that script can steal the user’s session cookie and send it to a remote server. With HttpOnly set, document.cookie simply omits that cookie — the script never sees it.
How do you set an HttpOnly cookie in Express.js?
What is HttpOnly Cookie
res.cookie(‘sessionId’, token, {
httpOnly: true, // blocks JS access
secure: true, // cookie only sent over HTTPS
sameSite: ‘strict’ // blocks cross-site sending
});
All three flags together — httpOnly, secure, and sameSite — form the standard baseline for securing session cookies in a production Node.js/Express app.
Does HttpOnly prevent CSRF attacks?
What is HttpOnly Cookie
No. HttpOnly protects against XSS-based cookie theft, not Cross-Site Request Forgery (CSRF). Because HttpOnly cookies are still sent automatically with every request to your domain, a malicious site can still trigger unwanted requests that carry the cookie along — that’s what CSRF tokens and SameSite are for. HttpOnly and CSRF protection are separate, complementary layers.
Is HttpOnly cookie enough for security on its own?
No. HttpOnly should always be combined with:
Secure— ensures the cookie is only sent over HTTPS, not plain HTTPSameSite— restricts whether the cookie is sent on cross-site requests- CSRF tokens — for state-changing requests, independent of cookie flags
- Short expiry / rotation — limits the damage window if a cookie does leak
HttpOnly vs Secure vs SameSite — what's the difference?
| Attribute | Protects Against | What It Does | Typical Setting |
|---|---|---|---|
| HttpOnly | XSS-based cookie theft | Blocks JavaScript (document.cookie) from reading the cookie | true for session/auth cookies |
| Secure | Network interception | Cookie only sent over HTTPS, never plain HTTP | true in production |
| SameSite | CSRF, cross-site tracking | Controls whether cookie is sent on cross-site requests (Strict, Lax, None) | Strict or Lax for auth cookies |
These three attributes are independent — set all of them together for auth/session cookies. None of them replaces the other two.
Can you access an HttpOnly cookie from JavaScript?
No — by design. That’s the entire purpose of the flag. If you need to read a cookie’s value in client-side JavaScript (for example, to check login state in the UI), that value has to come from a non-HttpOnly cookie or, better, from an API call to your backend that checks the HttpOnly session cookie server-side and returns just a boolean or user object.
Conclusion
In conclusion, HttpOnly cookies provide an additional layer of security to protect user information and mitigate the risk of XSS attacks. By preventing client-side scripts from accessing cookie data, the chances of attackers stealing sensitive information are greatly reduced.
However, it’s important to remember that HttpOnly cookies should not be considered the sole solution for web security. Websites should implement a comprehensive security strategy that includes other measures to protect against different types of attacks.
When using HttpOnly cookies for storing JWT tokens, the token is securely transmitted between the server and the browser. By leveraging the browser’s automatic inclusion of the cookie in subsequent requests, the token is handled seamlessly without exposing it to potential security risks.
Remember to properly secure the JWT token itself by signing and encrypting it, and be aware of the limitations of HttpOnly cookies. By combining multiple security measures, you can create a robust and secure authentication mechanism for your web application.
If you are interested to know more follow our software training institute in Kerala .
