Is HttpOnly necessary when SSL is already set?

StackOverflow https://stackoverflow.com/questions/8611871

  •  27-03-2021
  •  | 
  •  

题

If I already set SSL for my application server, do I still need to set HttpOnly for the cookies?

有帮助吗？

解决方案

Yes. The two flags have nothing to do with each other (both are security/privacy options, though)

  • "Secure" means that the cookie will only be sent over encrypted connections

  • "HttpOnly" means that the cookie will not be visible to Javascript

You could still have XSS on an HTTPS page, for example (and then an evil script could eat your cookie).

许可以下： CC-BY-SA 和 归因
不隶属于 StackOverflow
scroll top