News for hackers. Stuff that matters.

A comment on SPAs Are Dead?. Parent comment

Re:SPAs Are Dead? by AlbinoDrought on Wednesday April 07, 2021 @03:11PM (#26729583)
Normal cookies are JS-accessible, but HTTP-only cookies should not be: "A cookie with the HttpOnly attribute is inaccessible to the JavaScript Document.cookie API; it is sent only to the server."

https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#re...

[ Parent | on HN ]
Re:SPAs Are Dead? by leipert on Wednesday April 07, 2021 @03:22PM (#26729743)
Ah thanks! This is new to me. That is indeed a concern, but probably can be worked around, e.g. by proxying requests to third party domains through the same Domain.
[ Parent | on HN ]
Re:SPAs Are Dead? by kreetx on Wednesday April 07, 2021 @04:37PM (#26730880)
You can't make the browser to send you cookies for other origins so you won't be able to use them from your server.
[ Parent | on HN ]