CookiesHttpOnly cookies: keeping session tokens away from XSS If an attacker can run script on your page, the first thing they reach for is your session cookie. One cookie flag — HttpOnly — takes that prize off the table. Jul 13, 2026 · 3 min read
