What does it mean for a cookie to be HTTP only?

If your browser supports HttpOnly, and you enable it for a cookie, a client-side script should NOT be able to read OR write to that cookie, but the browser can still send its value to the server. However, some browsers only prevent client side read access, but do not prevent write access.

Should CSRF token be HttpOnly?

Since front-end frameworks like React run entirely on the client, there's no way to get access to httpOnly cookies. If you use httpOnly for your CSRF token, you won't be able to perform requests like POST, PATCH, DELETE, etc. That's why your CSRF token needs to be in a cookie with httpOnly set to false.

What is the HTTP only flag?

In short, the HttpOnly flag makes cookies inaccessible to client-side scripts, like JavaScript. Those cookies can only be edited by a server that processes the request. This is the main reason why CookieScript (which is a JavaScript-based solution) cannot control cookies with the HttpOnly flag.

Are HttpOnly cookies safe?

Even though HTTP-only cookies are not accessible to client-side scripts, they are still vulnerable to attacks that exploit vulnerabilities in the browser itself, such as XSS or CSRF attacks.

HttpOnly is an additional flag included in a Set-Cookie HTTP response header. Using the HttpOnly flag when generating a cookie helps mitigate the risk of …
In short, the HttpOnly flag makes cookies inaccessible to client-side scripts, like JavaScript. Those cookies can only be edited by a server …
The HttpOnly attribute prevents the cookie from being accessed through JavaScript. This helps mitigate certain types of attacks, such as cross- …