What effect does the HttpOnly attribute have on a cookie?
q17 · grounded · HTTP 200 · index 0fc1763d6701
What survived the check — each claim with the passage that supports it
The HttpOnly attribute limits the scope of the cookie to HTTP requests and instructs the user agent to omit the cookie when providing access to cookies via non-HTTP APIs such as browser APIs that expose cookies to scripts.
rfc6265#4.1.2.6 — 100% of
this claim's content words appear in that passage.
If a cookie was received from a non-HTTP API and the cookie's http-only-flag is set, the user agent aborts the storage steps and ignores the cookie entirely.
rfc6265#5.3 — 69% of
this claim's content words appear in that passage.
The HttpOnly attribute is independent of the Secure attribute, so a cookie can have both the HttpOnly and the Secure attribute.
rfc6265#4.1.2.6 — 100% of
this claim's content words appear in that passage.
What was retrieved — the passages the drafter saw, and nothing else
| rank | section | score |
|---|---|---|
| 1 | RFC 6265 Section 4.1.2.6: The HttpOnly Attribute |
0.8047 |
| 2 | RFC 6265 Section 5.2.6: The HttpOnly Attribute |
0.7875 |
| 3 | RFC 6265 Section 4.1.2.5: The Secure Attribute |
0.5658 |
| 4 | RFC 6265 Section 3.1: Examples |
0.5606 |
| 5 | RFC 6265 Section 8.6: Weak Integrity |
0.5400 |
| 6 | RFC 6265 Section 5.2.5: The Secure Attribute |
0.5388 |
| 7 | RFC 6265 Section 5.3: Storage Model |
0.5354 |
| 8 | RFC 6265 Section 5.4: The Cookie Header |
0.5278 |
| 9 | RFC 6265 Section 8.5: Weak Confidentiality |
0.5263 |