CyberCertPrepWeb App FundamentalsCookies & SessionsEASYFree question
What is the primary risk of using 'httpOnly: false' for a session cookie containing a sensitive JWT?
- A.Without HttpOnly, JavaScript can read the cookie via document.cookie. Any XSS vulnerability - even in a third-party script - can exfiltrate the JWT to an attacker's server, providing a stolen valid session token. HttpOnly is the primary defense: cookies are sent with HTTP requests but are invisible to JavaScript
- B.Non-HttpOnly cookies are automatically sent via HTTP instead of HTTPS
- C.Non-HttpOnly cookies have weaker encryption applied by the browser
- D.SameSite restrictions do not apply to non-HttpOnly cookies
Why A is correct
HttpOnly is specifically designed to prevent JavaScript from reading the cookie value. Without it, document.cookie returns the session token and any XSS (even in a third-party analytics script) can read and exfiltrate it. With HttpOnly, the cookie is opaque to JavaScript - the browser sends it automatically but JS cannot inspect its value. This is why HttpOnly session cookies are significantly more resilient to XSS compared to tokens stored in localStorage or non-HttpOnly cookies.
Know someone studying for Web App Fundamentals? Send them this one.