Web Security · Junior · Question 45 of 75
What does the HttpOnly cookie attribute do?
- 1The cookie is sent only over HTTP, not HTTPS
- ✓Correct answer: JavaScript can't read the cookie through
document.cookie, but the browser still sends it with requests - 3The cookie is deleted when the page reloads
Explanation
An XSS script can't steal an HttpOnly session cookie. It can still send requests that use it, so HttpOnly limits damage rather than preventing XSS.