EngineeringScoreSecurity Small
Mark cookies as HttpOnly
The HttpOnly attribute hides a cookie from JavaScript: document.cookie simply will not return it. That matters because it is the last line of defense if the page ever has an XSS vulnerability: without HttpOnly, a single injected script is enough to read and exfiltrate every session cookie on the page.
Why it matters
Cookies without HttpOnly are readable by any JavaScript on the page, so a single XSS bug is enough for an attacker to steal session cookies and take over accounts.
How to fix
- 1 Add the HttpOnly attribute to session and authentication cookies.
- 2 Only omit it for cookies a legitimate client-side script genuinely needs to read.
Common mistakes
- Omitting HttpOnly on session cookies because some client-side code reads them for convenience, when that read could usually be replaced with a server-provided value instead.
- Assuming HttpOnly makes XSS harmless: it protects cookies specifically, but an XSS bug can still perform actions as the logged-in user via other means.
- Setting it on some cookies but missing ones added later by new features or third-party auth integrations.
How to verify
- 1 Open the browser console and run document.cookie. Confirm session/auth cookies do not appear in the output.
- 2 Inspect the Set-Cookie response headers directly and confirm HttpOnly is present for sensitive cookies.
- 3 Re-test the page after adding any new cookie-setting feature to make sure the flag was not forgotten.
Related checks
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.