I've been implementing HTTPOnly cookie-based session handling and have some questions about what HTTPOnly means.
I realise it's a flag that gets passed around in the HTTP header when setting cookies. I also realise that most browsers refuse to allow modification of said cookies via client-side scripting.
The idea, if I've grasped correctly, is that Mr Example browses to an compromised page, his IE9 browser or whatever will reject any attempts at cookie-theft from the planted script.
However, seeing as the cookie is stored on the client-side, the actual HTTPOnly flag means little for anyone determined right? If it's stored on the client-side, then surely the client can find a way to alter the contents outside of a legitimate HTTP request?
If so, am I right in reasoning that HTTPOnly isn't to protect against non-HTTP modification from the client itself, but rather modification via malicious scripts running on a modern enough client? I.e., not blocking potentially-malicious modification of cookies by the client per se, but unknowing modifications specifically?