If I already set SSL for my application server, do I still need to set HttpOnly for the cookies?
Share
Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
If I already set SSL for my application server, do I still need to set HttpOnly for the cookies?
Yes. The two flags have nothing to do with each other (both are security/privacy options, though)
“Secure” means that the cookie will only be sent over encrypted connections
“HttpOnly” means that the cookie will not be visible to Javascript
You could still have XSS on an HTTPS page, for example (and then an evil script could eat your cookie).