A penetration test reveals that session cookies do not have the HttpOnly attribute set. What is the recommended mitigation?

Question

Options

• AAdd the HttpOnly attribute to all session cookies
• BAdd the HttpOnly attribute to all session cookies
• CStore session data in local storage instead
• DSet long expiration times for session cookies

• A
  83% (52)
• B
  11% (7)
• C
  5% (3)
• D
  2% (1)

Explanation

Setting the HttpOnly attribute on session cookies is the correct mitigation because it instructs the browser to block JavaScript access to the cookie - meaning even if an attacker injects malicious script (XSS), the script cannot read or steal the session token via document.cookie.

Why the distractors are wrong:

• B is identical to A, so if it appears different on a real exam, it's a distractor by wording; here it's simply a duplicate.
• C (local storage) is worse - local storage has no HttpOnly equivalent and is fully accessible to JavaScript, making it even more vulnerable to XSS theft.
• D (long expiration times) increases risk by extending the window of opportunity for session hijacking; it does nothing to prevent cookie theft.

Memory tip: Think "HttpOnly = JavaScript can't." The flag tells the browser the cookie is for HTTP transport only - no script access allowed. Pair it with Secure (HTTPS only) for full cookie hardening.

No community discussion yet for this question.