Contents
Yes, they are a viable option for an Ajax based site. Authentication cookies aren’t for manipulation by scripts, but are simply included by the browser on all HTTP requests made to the server.
AJAX calls only send Cookies if the url you’re calling is on the same domain as your calling script. This may be a Cross Domain Problem.
The whole point of CSRF mitigation is to be able to detect when the request didn’t come from your own domain (i.e. from your user interacting with your application). If you are using a cookie for CSRF, then, you shouldn’t do that, and you should spend your time rethinking that rather than making it an httpOnly cookie.
Is HttpOnly cookie secure?
HttpOnly and secure flags can be used to make the cookies more secure. When a secure flag is used, then the cookie will only be sent over HTTPS, which is HTTP over SSL/TLS. When the HttpOnly flag is used, JavaScript will not be able to read the cookie in case of XSS exploitation.
How do you send cookies in Cors Ajax call?
How to Pass Cookies on a Cross-Domain AJAX Request from Browser to Server
- Configure your AJAX request to pass cookies.
- Set the response headers to conform with CORS.
To configure WebSEAL to pass the HTTPOnly attribute from Set-Cookie headers sent by junctioned servers, change the value of pass-http-only-cookie-attr in the [junction] stanza of the WebSEAL configuration file to yes .
Alike to SESSION_COOKIE_HTTPONLY with session cookie, but for the csrf one? A new setting, CSRF_COOKIE_HTTPONLY, is available in Django 1.6+. For Django1.6+, check the accepted answer. For Django1.5 and prev, there is not setting option for this.
Why do I need to use HttpOnly for Ajax?
If you want to be sure that an AJAX request is authenticated, the request itself AND the HTTP headers need to contain the cookie. Eg through the use of scripts or unique hidden inputs. HTTPOnly would hinder that. Usually the interesting reason to want HTTPOnly is to prevent third-party content included on your webpage from stealing cookies.
Why are cookies included in an HTTP request?
Authentication cookies aren’t for manipulation by scripts, but are simply included by the browser on all HTTP requests made to the server. Scripts don’t need to worry about what the session cookie says – as long as you are authenticated, then any requests to the server initiated by either a user or the script will include the appropriate cookies.
Do you have to have cookies to use Ajax?
AJAX doesn’t need access to cookies to work, it can make requests on its own to extract information, the page request that the AJAX call makes could access the cookie data & pass that back to the calling script without Javascript having to directly access the cookies There’s a bit more to this.