1. What is HttpOnly?
If you set the HttpOnly attribute in the cookie, the cookie information cannot be read through the js script , and the cookie can only be obtained through http.
If a browser that supports HttpOnly detects a cookie containing the HttpOnly flag, and client script code attempts to read that cookie, the browser will return an empty string as a result. This makes the attack fail by preventing malicious code (usually XSS) from sending data to the attacker's website.
Cross-site scripting (XSS) attacks are often aimed at stealing session cookies.
In this attack, the cookie value is accessed by a client-side script using JavaScript (document.cookie) . However, in everyday use, web applications rarely need to access cookies through JavaScript. Therefore, a method to prevent cookies from being stolen was devised: a flag that tells web browsers that cookies can only be accessed through HTTP - the HttpOnly flag.
The HttpOnly flag is not new. It was first implemented in Microsoft Internet Explorer 6 SP1 in 2002 to prevent sensitive information from being stolen. Currently, every major browser supports HttpOnly cookies.
How does HttpOnly work?
The HttpOnly attribute is an optional attribute of the Set-Cookie HTTP response header, which is sent by the web server to the web browser along with the web page in the HTTP response. Here is an example of setting a session cookie using the Set-Cookie header:
HTTP/2.0 200 OK Content-Type: text/html Set-Cookie: sessionid=QmFieWxvbiA1The session cookie above is not protected and can be stolen in an XSS attack. However, accessing it with JavaScript can be prevented if the session cookie is set as follows:
Set-Cookie: sessionid=QmFieWxvbiA1; HttpOnlyHow to set HttpOnly server side?
All modern backend languages and environments support setting the HttpOnly flag. Here's an example of how to do it in PHP using the setcookie function:
setcookie("sessionid", "QmFieWxvbiA1", ['httponly' => true]);The last value (true) means setting the HttpOnly attribute.
Other Signs of Secure Cookies
The HttpOnly flag is not the only flag you can use to protect cookies. There are two more useful methods here.
Secure flag
The secure flag is used to declare that the cookie may only be sent using a secure connection (SSL/HTTPS). If this cookie is set, the browser will never send it if the connection is HTTP. This flag prevents cookie theft via man-in-the-middle attacks.
Note that this flag can only be set during HTTPS connections. If it is set during an HTTP connection, it will be ignored by the browser.
.....
Reference article:
HttpOnly Flag – Protect Cookies from XSS Attacks - Web Security
https://www.cnblogs.com/softidea/p/6040260.html