I have a question related to HttpOnly cookie. Tracking other threads wasn't of much help, hence I am posting my query here to learn if you can foresee any issues with my understanding.
There is a website, let’s say www.example.com which sets cookie at 2 stages.
- Connection between Load Balancer and Client -- LB_Cookie -- encrypted
- Connection between Client and Web Server -- ASP.NET_Session_Cookie -- encrypted & HttpOnly
In the above example, the ASP.NET_Session_Cookie is HttpOnly (secure from XSS attacks) - this is the cookie containing user’s session information. However, for LB_Cookie the HttpOnly flag is not set. I wonder if this could be an issue. Based on the information I obtained through resources on the internet - “all” cookies should be set to HttpOnly. However, they fail to explain what could go wrong if one of the cookies (Load Balancer cookie in my case) is not HttpOnly.
The purpose of LB_Cookie is such that the load balancer can remember, which web server it needs to send the incoming client requests to. There is no user specific data stored on this cookie. Is there anything wrong if it is not HttpOnly? I understand that it may be possible to steal LB_Cookie but even if this cookie is stolen, nothing much could go wrong because the attacker will not be able to take over user’s session. This is my understanding, and I am not able to imagine a scenario which could lead to trouble when LB_Cookie is not HttpOnly. Hence, I post these thoughts here for your opinion.