I was trying cookie stealing on a java and spring based web application. Normally, a cookie can be obtained through <script>alert(document.cookie)</script>, but in the above code, cookie is not alerted.

Burpsuite and tamperdata tools are showing this cookie: jsessionid=XXXXXXX..XXX

Is there any way to catch cookies client-side through javascript?

1 Answer 1


You can read the values of cookies using document.cookie or other client side solutions only if that particular cookie is not flagged as HttpOnly (assuming the browser you're using supports this flag).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .