Browser & Web Performance · Senior · Question 52 of 75

What does an `HttpOnly` session cookie NOT protect against when there's XSS?

✓Correct answer: The injected script making authenticated requests as the user from within the page
2The cookie being sent over plain HTTP
3The script reading the cookie value directly

Explanation

The attacker can't steal the cookie, but can still act as the user while the page is open. Preventing XSS remains essential.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.