{"question":"What effect does the HttpOnly attribute have on a cookie?","state":"grounded","http_status":200,"index_version":"0fc1763d6701","answer":"The HttpOnly attribute limits the scope of the cookie to HTTP requests and instructs the user agent to omit the cookie when providing access to cookies via non-HTTP APIs such as browser APIs that expose cookies to scripts. [rfc6265#4.1.2.6] If a cookie was received from a non-HTTP API and the cookie's http-only-flag is set, the user agent aborts the storage steps and ignores the cookie entirely. [rfc6265#5.3] The HttpOnly attribute is independent of the Secure attribute, so a cookie can have both the HttpOnly and the Secure attribute. [rfc6265#4.1.2.6]","message":"","citations":["rfc6265#4.1.2.6","rfc6265#5.3"],"supported":[{"text":"The HttpOnly attribute limits the scope of the cookie to HTTP requests and instructs the user agent to omit the cookie when providing access to cookies via non-HTTP APIs such as browser APIs that expose cookies to scripts.","citation":"rfc6265#4.1.2.6","coverage":1.0},{"text":"If a cookie was received from a non-HTTP API and the cookie's http-only-flag is set, the user agent aborts the storage steps and ignores the cookie entirely.","citation":"rfc6265#5.3","coverage":0.6923},{"text":"The HttpOnly attribute is independent of the Secure attribute, so a cookie can have both the HttpOnly and the Secure attribute.","citation":"rfc6265#4.1.2.6","coverage":1.0}],"withdrawn":[],"consulted":[{"section_id":"rfc6265#4.1.2.6","citation":"RFC 6265 Section 4.1.2.6: The HttpOnly Attribute","rank":1,"score":0.8047},{"section_id":"rfc6265#5.2.6","citation":"RFC 6265 Section 5.2.6: The HttpOnly Attribute","rank":2,"score":0.7875},{"section_id":"rfc6265#4.1.2.5","citation":"RFC 6265 Section 4.1.2.5: The Secure Attribute","rank":3,"score":0.5658},{"section_id":"rfc6265#3.1","citation":"RFC 6265 Section 3.1: Examples","rank":4,"score":0.5606},{"section_id":"rfc6265#8.6","citation":"RFC 6265 Section 8.6: Weak Integrity","rank":5,"score":0.54},{"section_id":"rfc6265#5.2.5","citation":"RFC 6265 Section 5.2.5: The Secure Attribute","rank":6,"score":0.5388},{"section_id":"rfc6265#5.3","citation":"RFC 6265 Section 5.3: Storage Model","rank":7,"score":0.5354},{"section_id":"rfc6265#5.4","citation":"RFC 6265 Section 5.4: The Cookie Header","rank":8,"score":0.5278},{"section_id":"rfc6265#8.5","citation":"RFC 6265 Section 8.5: Weak Confidentiality","rank":9,"score":0.5263}],"budget":{"deadline_ms":150.0,"elapsed_ms":0.849,"exceeded":false,"stages":{"retrieval":0.384,"drafting":0.004,"grounding":0.443}}}