javascript - How can I create securehttpOnly cookies with document.cookie? - Stack Overflow

admin管理员组

文章数量:1405636

If I create the function:

function setCookie(name, value)
    {
      // this works:
      // document.cookie=name + "=" + escape(value) + "; path=/;";
      // this does not:
      // document.cookie=name + "=" + escape(value) + "; path=/; secure; HttpOnly; SameSite=strict";
    }

setCookie('my_cookie','some_random_value');

I am not 100% on why this second option is not working. Any ideas anyone?

If I create the function:

function setCookie(name, value)
    {
      // this works:
      // document.cookie=name + "=" + escape(value) + "; path=/;";
      // this does not:
      // document.cookie=name + "=" + escape(value) + "; path=/; secure; HttpOnly; SameSite=strict";
    }

setCookie('my_cookie','some_random_value');

I am not 100% on why this second option is not working. Any ideas anyone?

• javascript
• cookies
• cookie-httponly

Share Improve this question Follow edited Mar 31, 2021 at 16:51 Barmar 784k5757 gold badges548548 silver badges659659 bronze badges asked Mar 31, 2021 at 16:48 simlpymarkbsimlpymarkb 38555 silver badges1313 bronze badges 2

• You can't create an HTTP-only cookie on the client. By definition it can only be created using HTTP from the server. – Barmar Commented Mar 31, 2021 at 16:50
• Does this answer your question? Set a cookie to HttpOnly via Javascript – Heretic Monkey Commented Mar 31, 2021 at 16:53

Add a ment  | 

1 Answer 1

Sorted by: Reset to default 5

See MDN:

A cookie with the HttpOnly attribute is inaccessible to the JavaScript Document.cookie API; it is sent only to the server. For example, cookies that persist server-side sessions don't need to be available to JavaScript, and should have the HttpOnly attribute. This precaution helps mitigate cross-site scripting (XSS) attacks.

You can't set it with document.cookie because the entire point of the flag is to prevent it being set (or read) with document.cookie.

本文标签： javascriptHow can I create securehttpOnly cookies with documentcookieStack Overflow