CODEWITHSUNDEEP
javascripthttp
Daniel Viglione
Daniel Viglione

Reputation: 9427

Get the cookie from an HTTP request header

On Google Chrome, when I look at the HTTP request headers under the "Network" tab using the chrome console, it provides me the following request headers:

Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding:gzip, deflate, sdch
Accept-Language:en-US,en;q=0.8
Cache-Control:max-age=0
Connection:keep-alive
Cookie:ASP.NET_SessionId=nlbupfbt32jda1tziep4p21r; .ASPXAUTH=8C94786DD4A3C03C5548973E04A76FF554F38D6EB74E0B006AB3C3F72684E94DC0469E28D22E4BBFA069B82B1CCFB4203627D998990C6C96897DDBB0F611809175D5F06F015604082481F0079AE48DAB7974F3D63242055BEC75F707C545666C67B7C9D9E53F7531020235881E9DA4F3C26FD02B0ED0971D02C64DFE96F67C745119F44BBC9E46DC2CEF61D639EA01B9
... more headers ...

What I am trying to get is the data under Cookie. I have tried document.cookie but it returns an empty string. How can I grab that cookie information?

Upvotes: 8

Views: 36648

Answers (2)

Alex Booker
Alex Booker

Reputation: 10777

Edit: document.cookies -> document.cookie document.cookie returns nothing because the cookie is almost certainly marked with the HttpOnly attribute.

The presence of this attribute tells the browser to disallow access to the cookie value via document.cookie.

This is a security measure to prevent against session hijacking via cross-site scripting mostly.

Upvotes: 8

symcbean
symcbean

Reputation: 48357

If the cookie was set with the http-only flag, you can't read it using JavaScript - this is a security measure to prevent session hijacking and should be set for any surrogate identifier including session cookies.

Upvotes: 1

Related Questions