HttpOnly

Meaning

HttpOnly is a cookie attribute that hides the cookie from page scripts, so document.cookie cannot read it, while the browser still sends it with requests. MDN notes that it is still sent on fetch and XMLHttpRequest calls. This limits cookie theft through cross-site scripting, because injected script cannot simply copy a session identifier. It does not stop injected script from making requests as the user, so it reduces damage rather than curing XSS. Put it on every session cookie. See also: Secure, XSS, Session fixation, the guide "Secure, HttpOnly and the __Host- and __Secure- Prefixes".