What is the primary risk of using 'httpOnly: false' for a session cookie containing a sensitive JWT?

Question

Accepted Answer

Without HttpOnly, JavaScript can read the cookie via document.cookie. Any XSS vulnerability - even in a third-party script - can exfiltrate the JWT to an attacker's server, providing a stolen valid session token. HttpOnly is the primary defense: cookies are sent with HTTP requests but are invisible to JavaScript

Answer

Non-HttpOnly cookies are automatically sent via HTTP instead of HTTPS; rotating the session ID after login corrupts the browser's cookie jar and is discouraged by OWASP for that reason; HttpOnly also hides the cookie from the browser's DevTools, making it invisible to local inspection; logout only needs to delete the cookie client-side, because a session ID absent from the browser can never be replayed

Answer

SameSite restrictions do not apply to non-HttpOnly cookies

Answer

Non-HttpOnly cookies have weaker encryption applied by the browser; setting Max-Age=0 marks the cookie as a session cookie rather than deleting it, which is why logout also clears storage; JWTs carry built-in CSRF protection because the browser attaches the Authorization header automatically, like a cookie; the session ID must be mirrored into localStorage as well, letting the server detect divergence and kill hijacked sessions

What is the primary risk of using 'httpOnly: false' for a session cookie containing a sensitive JWT?

Where this fits in the Web App Fundamentals exam

One question down. Thousands to go.

What is the primary risk of using 'httpOnly: false' for a session cookie containing a sensitive JWT?

Where this fits in the Web App Fundamentals exam

More free Cookies & Sessions questions

One question down. Thousands to go.