Security Small
Mark cookies as HttpOnly
The HttpOnly attribute hides a cookie from JavaScript: document.cookie simply will not return it. That matters because it is the last line of defense if the page ever has an XSS vulnerability: without HttpOnly, a single injected script is enough to read and exfiltrate every session cookie on the page.
Find out whether your site has this problem, and every other check, in one free scan.
Check your site freeWhy it matters
Cookies without HttpOnly are readable by any JavaScript on the page, so a single XSS bug is enough for an attacker to steal session cookies and take over accounts.
How to fix
- 1 Add the HttpOnly attribute to session and authentication cookies.
- 2 Only omit it for cookies a legitimate client-side script genuinely needs to read.
Common mistakes
- Omitting HttpOnly on session cookies because some client-side code reads them for convenience, when that read could usually be replaced with a server-provided value instead.
- Assuming HttpOnly makes XSS harmless: it protects cookies specifically, but an XSS bug can still perform actions as the logged-in user via other means.
- Setting it on some cookies but missing ones added later by new features or third-party auth integrations.
How to verify
- 1 Open the browser console and run document.cookie. Confirm session/auth cookies do not appear in the output.
- 2 Inspect the Set-Cookie response headers directly and confirm HttpOnly is present for sensitive cookies.
- 3 Re-test the page after adding any new cookie-setting feature to make sure the flag was not forgotten.
Related checks
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.