CODEWITHSUNDEEP
javascriptangularjscookiessingle-page-applicationrestful-authentication
Parag Diwan
Parag Diwan

Reputation: 25

Query about accessing HttpOnly Cookie & Secure cookie

I am working on RESTful SPA app using angularJS. Currently initial REST call is setting a "token" cookie on xyz.com ( secured response cookie) after successful user login. I am not able to read this cookie in Javascript/angular as I am working on localhost.

What I understood here , unless I run this app from xyz.com , i wont be able to access this cookie OR do I need a secured connection ?

Is my Understanding correct ?

Secondly, my understanding about "httponly" cookie is that , it wont be accessible from javascript even though you are on same host.

Please correct my understanding.

Upvotes: 1

Views: 3527

Answers (1)

Quentin
Quentin

Reputation: 943517

As the author of a website:

  • You cannot read a cookie for a different site (ever)
  • You cannot read an HTTP Only cookie with JavaScript
  • You cannot read a Secure cookie unless it is served over HTTPS

That's three separate conditions, with independent effects, and none, some or all of them can apply to any given cookie.

Therefore if a cookie is secure and for a different site then you can't read it no matter if you use HTTPS or not (since different site blocks you even if secure does not).

Upvotes: 4

Related Questions