Search code examples
javascriptsession-cookies

Can't access a session cookie with a domain and path


I want to know : why i can't access this session cookie that has a domain and path ?

Is there a solution ?

enter image description here


Solution

  • You haven't shown all the data from the cookie inspector, but most session cookies are marked httpOnly which explicitly sets them to be inaccessible to client-side JavaScript.

    There is almost never a good reason for client-side JS to access a cookie identifier, so marking them as httpOnly prevents an XSS attack from passing the session ID to an attacker (which would make it much easier to hijack the session).