Finding: Cookie Missing HttpOnly Flag
A cookie set by this site is missing the HttpOnly attribute, so JavaScript running on the page is allowed to read it.
Last updated August 11, 2026.
What it means
The HttpOnly attribute on a Set-Cookie header tells the browser to keep that cookie out of document.cookieand any other script-facing API — it is only ever sent as part of an HTTP request, never handed to page JavaScript. Without it, any script that runs on the page, first-party or not, can read the cookie's value directly. This finding is scoped to that flag alone: it says nothing about whether the same cookie is also missing Secure or SameSite, which are reported as their own separate findings.
Why it matters
Most sites load some code they don't fully control — a third-party widget, an analytics snippet, an ad script. If any script from elsewhere is ever compromised, or if the site has a cross-site scripting (XSS) bug that lets an attacker inject a script, a cookie without HttpOnly can be read and exfiltrated by that script. This is most dangerous for a session or authentication cookie, since reading it is often enough to impersonate the signed-in visitor. Cookies that legitimately need to be readable by page JavaScript — a CSRF token the frontend has to attach to requests, for instance — are the exception, not the default.
What Nivaronix checks
Nivaronix makes a live request to the domain and inspects each Set-Cookie header in the response, parsing its attributes. This finding fires once per cookie found without an HttpOnly attribute. This is a configuration check against the live response — not a vulnerability scan, and it does not attempt to inject or execute any script.
Example evidence (illustrative — not live scan data)
Missing HttpOnly:
Set-Cookie: session=abc123; Path=/; Secure
Fixed:
Set-Cookie: session=abc123; Path=/; Secure; HttpOnly
How to fix it
Add HttpOnlyto the cookie's options wherever it's set in application code. Session and authentication cookies almost never need to be readable by page JavaScript, so this is safe to enable broadly unless you know your frontend specifically reads a given cookie.
Express (Node.js)
res.cookie("session", token, {
httpOnly: true,
secure: true,
sameSite: "lax",
});Django
# settings.py # Django's session cookie is HttpOnly by default; confirm it hasn't # been overridden. SESSION_COOKIE_HTTPONLY = True
Rails
# config/environments/production.rb Rails.application.config.session_store :cookie_store, httponly: true
Raw header
Set-Cookie: name=value; Secure; HttpOnly; SameSite=Lax
How to verify the fix
Open your browser's DevTools → Application (Chrome) or Storage (Firefox) → Cookies, select the cookie, and confirm the HttpOnly column is checked. Or re-run the website security scanner and confirm this finding no longer appears.