Browser & Web Performance · Junior · Question 65 of 75

What does the `HttpOnly` flag on a cookie do?

1Deletes the cookie when the tab closes
✓Correct answer: Makes the cookie inaccessible to JavaScript (document.cookie)
3Sends the cookie only over HTTP, never HTTPS

Explanation

An XSS payload then can't read a session cookie directly, which limits the damage.

Further reading

Test yourself

Take the Browser & Web Performance · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.