Cookie without Http Only flag set
Summary: PortSwigger Research describes the HttpOnly cookie attribute as a setting that prevents client-side JavaScript from reading or setting a cookie's value, which makes cross-site scripting attacks slightly harder to exploit by blocking trivial capture of the cookie via an injected script. The guidance states there is usually no good reason not to set the flag on all cookies unless legitimate client-side scripts specifically need to read or set a cookie's value, and notes the restrictions can potentially be circumvented in some circumstances and that script injection enables numerous other serious attacks beyond cookie theft.
Key Takeaway: The flag is rated Low severity, but the same script injection that HttpOnly frustrates can deliver numerous other serious attacks, so treating a missing flag as a closed ticket leaves the injection path itself unaddressed.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026