security session_security ai_generated true

Session token stolen via XSS — cookie missing HttpOnly flag

ID: security/httponly-cookie-missing-xss-token-theft

Also available as: JSON · Markdown
90%Fix Rate
92%Confidence
4Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

Session tokens in cookies without HttpOnly flag are accessible to JavaScript.

generic

Workarounds

  1. 95% success Set HttpOnly and Secure flags on all session cookies 
    Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Strict

    Sources: https://owasp.org/www-community/HttpOnly

  2. 90% success Use SameSite=Strict alongside HttpOnly 
    SameSite prevents cross-site sending; HttpOnly prevents JS access

    Sources: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie

Dead Ends

Common approaches that don't work:

  1. Store token in localStorage instead 85% fail

    localStorage is always accessible to JavaScript; even more vulnerable to XSS

  2. Add XSS filtering in JavaScript to protect cookies 80% fail

    Client-side filtering can be bypassed; attacker controls the JavaScript context