Learning term
HttpOnly cookie — Accounts, authentication, and sessions
HttpOnly cookie restricts session cookies to HTTPS and removes JavaScript access. This card shows its role in “Accounts, authentication, and sessions” and a safe diagnostic path.
Orientation
HttpOnly cookie restricts session cookies to HTTPS and removes JavaScript access. At this level, separate purpose, input, and visible result. Place HttpOnly cookie within Accounts, authentication, and sessions before changing settings or files.
Practical use
Inspect Set-Cookie in the browser when a cookie disappears over HTTP or is script-readable. Start in a sandbox with neutral examples. Record the expected state, make one controlled change, and compare status output, application behavior, and logs.
Technical understanding
HttpOnly cookie restricts session cookies to HTTPS and removes JavaScript access. Technically, HttpOnly cookie connects through interfaces, configuration, state, or dependencies. Trace data from input to output and check versions, permissions, networking, storage, and resources separately.
Operations and debugging
Inspect Set-Cookie in the browser when a cookie disappears over HTTP or is script-readable. In production-like operations, use measurable signals, least privilege, reproducible configuration, and a documented rollback. Preserve evidence, isolate the cause, and verify the correction with the same test.
Exercise
Try it safely
Inspect Set-Cookie in the browser when a cookie disappears over HTTP or is script-readable. Open an isolated test environment and run “curl -I https://example.com/login”. Write down the expected output first, do not alter production data, and record one safe next diagnostic step.
curl -I https://example.com/loginQuick check
Can you explain the purpose, observable state, and most common failure source of HttpOnly cookie — Accounts, authentication, and sessions in one sentence each? Which evidence would you preserve before changing anything, and which repeated test would prove that the correction actually worked?