How to read http-only cookie using JavaScript

Question

Is there a way to read a secure cookie with javascript? I tried to do this with document.cookie, and as far as I can see here http://securitymusings.com/article/909/secure-cookies-the-httponly-flag I can’t access the secure cookie this way.

Can someone suggest me a workaround?

Answer 1

Different browsers include different security measures when the HTTPOnly flag is set . For example, Opera and Safari do not prohibit JavaScript from writing to cookies. However, reading is always prohibited in the latest version of all major browsers.

But more importantly, why do you want to read an HTTPOnly cookie? If you are a developer, just turn off the flag and make sure you check your xss code . I recommend that you avoid disabling this flag, if possible. HTTPOnly flag and the "safe flag" (which causes cookies to be sent via https) must be set.

If you are an attacker, then you want to hijack a session . But there is an easy way for an HTTPOnly session, despite the HTTPOnly flag. You can still ride in sessions without knowing the session ID. The MySpace Samy worm did just that. He used XHR to read the CSRF token and then perform an authorized task. Thus, an attacker can do almost everything that a registered user can do.

People too strongly believe in the HTTPOnly flag, XSS can still be used. You must establish barriers around sensitive functions. For example, to change the password, you must specify the current password. The ability of an administrator to create a new account must require captcha, which is a CSRF prevention method that cannot be easily circumvented with XHR .

Answer 2

The whole point of HttpOnly cookies is that they cannot be accessed by JavaScript.

The only way (except for using browser errors) for your script to read them is to have an interacting script on the server that will read the cookie value and repeat it as part of the response content. But if you can and want to do this, why use HttpOnly files in the first place?