thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

HttpOnly Cookie Attribute

A cookie flag that prevents client-side scripts from reading the cookie, reducing session theft via XSS.

Definition

With HttpOnly set, document.cookie cannot access the value, though the browser still sends it with requests. It limits the impact of XSS but does not prevent XSS or CSRF.

Example

Set-Cookie: sessionid=abc123; HttpOnly; Secure; SameSite=Lax

Exam tip

HttpOnly stops script access, Secure forces HTTPS, SameSite limits cross-site sending.

Related terms