JavaScript · Middle · Question 41 of 75
Why is a cookie with the HttpOnly flag safer than a regular one?
- ✓Correct answer: It can't be read from JavaScript, so XSS can't steal its value
- 2It's sent only over HTTP and never over HTTPS
- 3The browser automatically encrypts it before storing
Explanation
HttpOnly blocks access via document.cookie. Session cookies also get Secure (HTTPS only) and SameSite (CSRF protection). That's why session tokens are safer in such cookies than in localStorage.