1

While reading "Tangled web" I came across description of http only cookies and I wanted to try it out in my project, so I've added these settings according according to docs:

CSRF_COOKIE_HTTPONLY = True
SESSION_COOKIE_HTTPONLY = True

And went to console to dive into it. As expected no csrf token or session cookie showed up when I executed some JS:

> document.cookie
"djdt=hide"

However, I have AJAX running in background polling some data from the server beginning with:

function doPoll() {
    $.get(predefinedUrl){
        (...)

And it seems that somehow it has access to this data: screenshot of request cookie headers.

My questions are: how is this data accessible? Is it enough that this script makes request to my site and browser handles the rest (like it does in "regular" cases)? Does it mean I should be able to securely switch on this http only flag by default and not worry that frontend scripts will not be able to make requests? Is there anything I should pay attention for?

  • How do you come to the conclusion that the script has access to the httpOnly cookies? – Arminius Feb 19 '18 at 23:25
1

how is this data accessible?

It's not. If your browser issues a request, including AJAX requests, it will include all cookies for the target domain in the Cookie header, even httpOnly cookies.1 However, your script can't access them since the headers Set-Cookie and Cookie are forbidden headers per specification and you can't extract them with, say, XMLHttpRequest.getResponseHeader('Set-Cookie').

Does it mean I should be able to securely switch on this http only flag by default and not worry that frontend scripts will not be able to make requests?

With httpOnly cookies your script can still make authenticated requests, it just can't read the values of the httpOnly cookies which are sent along. Turning on httpOnly only breaks functionality if you explicitly handle the cookies on the client side.

1 sameSite cookies can be an exception.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.