6

Can Javascript overwrite or delete a HTTPOnly cookie?

In more detail: Suppose the user's browser has a cookie for example.com with the HTTPOnly flag set, say session=552..e0. Suppose the user visits a page on example.com. Can Javascript running on that page overwrite the cookie with a new cookie that does not have the HTTPOnly cookie flag set? Will that effectively delete the existing HTTPOnly cookie? Can I count on browsers to prevent this?


Research I've done: The Google Browser Security Handbook says:

no specific thought was given to preventing JavaScript from overwriting httponly cookies

but I know that those pages are quite old right now, and that quote is not entirely explicit about what is possible. A table on the same page says that on MSIE, Firefox 3, Opera, and Chrome, Javascript cannot overwrite HTTPOnly cookies, but Safari and Android browsers can -- but again, that's a very old resource. Mozilla's documentation is not clear on this point.

7

While you might not be able to rewrite the cookie you might be able to shadow it. The specific behavior depends on the browser though. With Firefox I can set a site-global HttpOnly cookie with path=/ and a JavaScript cookie with a different path. If I visit this path then I get both cookies:

# In server response
Set-Cookie: Foo=http; HttpOnly; Path=/

# In document script
document.cookie = "Foo=js; path=/f;"

# Request when visiting path /f
Cookie: Foo=js; Foo=http;

In Chrome though it shows in the request only a single cookie, the one with the HttpOnly flag. It has the other cookie stored locally though and can access it with JavaScript.

For more on this see also Cookies Lack Integrity: Real-World Implications from Usenix 2015. The findings there might be no longer fully true though since the browsers might have changed their behavior in the meantime.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.