The cookie can be read by scripts (no HttpOnly attribute).

COOKIE_NO_HTTPONLY · Severity: Info

• InfoCOOKIE_NO_HTTPONLY

  The cookie can be read by scripts (no HttpOnly attribute).

  Without HttpOnly, JavaScript on the page can read the cookie, so an injected script can steal it. That is fine for cookies the page's own scripts need, but not for session cookies.

  Recommendation: Add HttpOnly to session and authentication cookies.

Reported by

• Set-Cookie parser

Available through the API

• Set-Cookie parser API

Related findings

• Info COOKIE_NO_SAMESITE The cookie has no SameSite attribute.
• Warning COOKIE_NO_SECURE The cookie has no Secure attribute.
• Warning COOKIE_NOT_SECURE The HTTPS site sets a cookie without the Secure attribute.
• Error COOKIE_INVALID The Set-Cookie value has no valid name=value pair.
• Info COOKIE_LONG_LIFETIME The cookie asks to live longer than the 400 days browsers allow.
• Info COOKIE_MULTIPLE The text holds more than one cookie; only the first was checked.

All findings