Contents
Press “F12” to open Developer Tools. Select “cache” and then “view cookie information”. If the application does not set the HTTPOnly flag on session cookies or if the application administrator cannot demonstrate mitigating controls, this is a finding.
If the HttpOnly flag is set, then your browser should not allow a client-side script to access the session cookie. However, some browsers only prevent client side read access, but do not prevent write access.
How do I check my cookies request?
To check cookies in Chrome, right-click on the website and click on Inspect. This will open up the Chrome developer console. From the developer console, go to the Applications tab, and then expand the Cookies dropdown under the Storage section.
Testing for the Secure Attribute Verifying that a web site sets this attribute on any particular cookie is easy. Using an intercepting proxy, like ZAP, you can capture each response from the server and examine any Set-Cookie headers it includes to see if the secure attribute is set on the cookie.
Using the HttpOnly tag when generating a cookie helps mitigate the risk of client-side scripts accessing the protected cookie, thus making these cookies more secure. If the HttpOnly flag is included in the HTTP response header, the cookie cannot be accessed through the client-side script.
Is HttpOnly Cookie safe?
Different Browsers enable different security measures when the HTTPOnly flag is set. For instance Opera and Safari do not prevent javascript from writing to the cookie. However, reading is always forbidden on the latest version of all major browsers. But more importantly why do you want to read an HTTPOnly cookie?
By using Cookies we can exchange information between the server and the browser to provide a way to customize a user session, and for servers to recognize the user between requests. HTTP is stateless, which means all request origins to a server are exactly the same and a server cannot determine if a request comes from a client that already did
What does it mean to treat Cookie as HttpOnly?
HttpOnly is a flag the website can specify about a cookie. In other words, the webserver tells your browser “Hey, here is a cookie, and you should treat is as HttpOnly”. An HttpOnly Cookie is not accessible by the JavaScript. Only the browser knows about it, and it doesn’t give it to the JavaScript code in the page.
From there onwards you are going to be able to identify clients based on the token included in their request. HTTP cookies were born to standardize this sort of mechanism across browsers: they’re nothing more than a way to store data sent by the server and send it along with future requests.