security security_warning ai_generated true

Warning: Cookie set without HttpOnly flag

ID: security/httponly-cookie-missing

Also available as: JSON · Markdown
92%Fix Rate
90%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

Cookies without HttpOnly flag are accessible via JavaScript, enabling XSS cookie theft.

generic

Workarounds

  1. 95% success Set HttpOnly flag on all session/auth cookies server-side 
    Set-Cookie: session=abc; HttpOnly; Secure; SameSite=Strict
  2. 90% success Use framework session middleware that sets HttpOnly by default 
    EXPRESS_SESSION, Django SESSION_COOKIE_HTTPONLY=True

Dead Ends

Common approaches that don't work:

  1. Set cookie via JavaScript document.cookie 88% fail

    JS-set cookies cannot have HttpOnly flag - must be set server-side.

  2. Rely on SameSite alone for protection 70% fail

    SameSite prevents CSRF but not XSS-based cookie theft.