How deeply does Grokking Web Application Security cover HttpOnly cookie attribute?

Defines the browser restriction and demonstrates header and framework configuration, without detailing browser internals.

HttpOnly cookie attribute

As explained in Grokking Web Application Security

The HttpOnly cookie attribute prevents client-side scripts from reading a cookie through browser scripting APIs.

Cookies normally remain readable by JavaScript in the browser. If an attacker injects JavaScript through cross-site scripting (XSS), that access can expose session cookies. The HttpOnly attribute tells the browser to keep a cookie value inaccessible to client-side scripts. section 2.13 section 9.7

Protecting a session cookie

Set the attribute in the response header: Set-Cookie: session_id=4b44bd3f-5186; Secure; HttpOnly. Use Secure with HttpOnly so the cookie is also restricted to a secure channel. section 9.7 section 2.13

Apply HttpOnly where cookies carry authentication or session state:

Mark session cookies HttpOnly so browser JavaScript cannot access session identifiers. section 9.11
Use the framework's httpOnly configuration option, which is often enabled by default in modern frameworks. section 9.7
Store JWT access tokens in HttpOnly cookies when avoiding direct exposure to client-side JavaScript. section 9.4
Treat HttpOnly as one layer of defense; content security policies and escaping still help protect sessions from XSS. section 9.7

HTTP/2.0 200 OK
Content-Type: text/html
Set-Cookie: session_id=9264be3c7df125; Secure; HttpOnly #1

Inspect a complete Set-Cookie header that combines Secure and HttpOnly. section 2.13

How Grokking Web Application Security covers it

Cover of Grokking Web Application Security

liveBook manning.com

Read Grokking Web Application Security on liveBook Get the book at manning.com

Related concepts

secure cookieused by · A secure cookie is an HTTP cookie that browsers transmit only over secure connections such as HTTPS.
cookieconfigures · An HTTP cookie is a small piece of data that a server asks a user agent to store and return with subsequent requests within its scope.
cross-site scripting attackaddresses · Cross-site scripting is a web security vulnerability in which attacker-controlled content causes executable script to run in another user’s browser within a trusted application context.
session hijackingaddresses · Session hijacking is an attack in which an adversary takes unauthorized control of an authenticated communication session by obtaining or manipulating its credentials or state.

This explainer was generated by Manning's knowledge graph from the text of Grokking Web Application Security. The section links point to the parts of the book it draws on.