Glossary term
What is HttpOnly (HttpOnly cookie attribute)?
HttpOnly stands for HttpOnly cookie attribute.
In The Browser Contract
A cookie setting that hides the cookie from JavaScript. An XSS attack cannot read it, but it can still use the logged-in session.
Learn it properly · The Browser ContractLesson 1: Storage in the Browser: Cookies, localStorage, sessionStorage and IndexedDBHow long each one lasts, how big it can be, and who can read it: the tab, the site, the server or JavaScript. It ends with a table that answers: where should this data go?In Security for Developers
A cookie setting that hides the cookie from JavaScript, so a script injected by XSS cannot read the session ID directly.
Learn it properly · Security for DevelopersLesson 3: Passwords and Login: Hashing, Sessions, MFA and Rate LimitsWhy you never store passwords, hashing with a salt (scrypt and Argon2), safe sessions and JWT mistakes, password reset flows, MFA, and stopping brute force.