Cookies without the HttpOnly flag set are accessible to JavaScript running in the same origin. In case of a Cross-Site Scripting (XSS) vulnerability, the cookie can be stolen by a malicious script. If a sensitive cookie does not need to be accessed directly by client-side JS, the HttpOnly flag should be set.

Set httponly to True, or add ; HttpOnly; to the cookie's raw header value, to ensure that the cookie is not accessible via JavaScript.

In the following examples, the cases marked GOOD show secure cookie attributes being set; whereas in the case marked BAD they are not set.
  • PortSwigger: Cookie without HttpOnly flag set
  • MDN: Set-Cookie.
    •