Home/ Questions/Q 343603
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-12T10:54:47+00:00

Searching for possible ways to get cookie with httpOnly enabled, I cannot find any.

  • 0

Searching for possible ways to get cookie with httpOnly enabled, I cannot find any. But then again, how do browser addons like Firebug, Add ‘N Edit Cookie, etc. can get the cookies? Can’t an attacker do the same?

So my question is, is it really, really impossible to get cookie of httpOnly enabled requests, using javascript?

p/s: Yes I’m aware httpOnly doesn’t stop XSS attacks. I’m also aware it’s futile against sniffers. Let’s just focus on javascript, sort of alert(document.cookie) type / pre httpOnly era.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    how do browser addons like Firebug,
    Add ‘N Edit Cookie, etc. can get the
    cookies?

    They are browser extensions, and the browser has access to the cookies ; extensions have a higher level of privileges than you JS code.

    is it really, really impossible to get
    cookie of httpOnly enabled requests,
    using javascript?

    Provided you are using a browser (ie, a quite recent browser) that support httpOnly and doesn’t have a security bug about it, it should be impossible — that’s the goal of httpOnly.

    Quoting wikipedia :

    When the browser receives such a
    cookie, it is supposed to use it as
    usual in the following HTTP exchanges,
    but not to make it visible to
    client-side scripts.

    • 0