Set a cookie to HttpOnly via Javascript
cookies, http, javascript
Solution
An `HttpOnly` cookie means that it's not available to scripting languages like JavaScript. So in JavaScript, there's absolutely no API available to get/set the `HttpOnly` attribute of the cookie, as that would otherwise defeat the meaning of `HttpOnly`.
Just set it as such on the server side using whatever server side language the server side is using. If JavaScript is absolutely necessary for this, you could consider to just let it send some (ajax) request with e.g. some specific request parameter which triggers the server side language to create an HttpOnly cookie. But, that would still make it easy for hackers to change the `HttpOnly` by just XSS and still have access to the cookie via JS and thus make the `HttpOnly` on your cookie completely useless.
Problem
I have a cookie that is NOT `HttpOnly` Can I set this cookie to `HttpOnly` via JavaScript?