Should cookies always be HttpOnly?
Security of cookies is an important subject. HttpOnly and secure flags can be used to make the cookies more secure. When a secure flag is used, then the cookie will only be sent over HTTPS, which is HTTP over SSL/TLS.
Can JavaScript delete HttpOnly cookies?
You won’t be able to remove all cookies. HttpOnly cookies are not modifiable by JavaScript. There is no 100% solution to delete browser cookies. The problem is that cookies are uniquely identified by not just by their key “name” but also their “domain” and “path”.
Why is it important to set cookies to HttpOnly and secure?
CSRF mitigations often rely on the server sending a value in a cookie, and expect javascript to read that value. The Secure flag is more important. If we expect all sites to run over https, and only https, then the only http part is a redirect to https. You never want your cookie sent in the clear. Well, almost never.
How to delete cookie or set HttpOnly and?
Have the server invalidate the authentication token (cookie) but setting it to some junk value. For example, Set-Cookie: token=loggedout. Deleting a cookie may be a client side action, but setting a cookie can be done on the server side and you can still maintain HTTPOnly and Secure (which, as 8zero2.ops pointed out, is unrelated to this issue).
How to set HttpOnly and secure on PHPSESSID Cookie?
I use Apache httpd over HTTPS, set session.cookie_httponly = 1 & session.cookie_secure = 1 works for me. Paste the code in the functions.php file. Using .htaccess for this purpose just slows down your application. I think its better to add this snippet in your main config file ( example config.php ) or main include file ( example global.php )
Why do I need to delete cookies from my server?
I can’t find any (security related) reasons for choosing to delete a cookie over setting Secure and HttpOnly. Secure flag has nothing to do with javascript involvement . It only enables or disable the transmission of cookies over insecure plain-text in case the server entertain http and https requests.