I'm facing a limitation in a backend system that can only set a single cookie via the Set-Cookie header which the front end uses to make an AJAX call to log the user in. The authentication system requires multiple cookies to be set not just the one.

If it is assumed this limitation can not be worked around: Is it secure to send the authentication cookies down as part of the JSON response to the login request i.e. as a text string? The front end JavaScript would then take this data and set the required cookies into the users browser. Both the AJAX call and page that the call is made on will be HTTPS.

1 Answer 1


This is less secure than the normal way to set cookies because you can't set the HttpOnly flag on your cookies. This means that the cookies can be read by Javascript, and this is particularly a problem if the website has an XSS vulnerability. In that case, the attacker can directly read your cookies and take over your session.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .