What is the purpose of HTTP-only cookies?

The HttpOnly flag is a security attribute set on a cookie by a web server. It instructs the browser to prevent client-side scripts (like JavaScript) from accessing the cookie's value via APIs such as document.cookie. This is a crucial defense mechanism against Cross-Site Scripting (XSS) attacks, where an attacker might inject a malicious script to steal session cookies and hijack a user's session.

B: This describes the Secure cookie attribute, which ensures the cookie is only sent over encrypted (HTTPS) connections.

C: The HttpOnly flag does not prevent the server from reading the cookie; the server needs to read it to maintain session state.

D: This is incorrect; the flag does not restrict transmission to HTTP and should be used with HTTPS for security.

- Ping Identity, PingAM 7.5 Documentation, "Security", section "Cross-site scripting (XSS) prevention". This section explicitly recommends setting the HttpOnly flag on session cookies.

- IETF, RFC 6265, "HTTP State Management Mechanism", Section 4.1.2.6, "The HttpOnly Attribute". This RFC defines the attribute and its purpose: "The HttpOnly attribute limits the scope of the cookie to HTTP requests... an HttpOnly cookie is not accessible to non-HTTP APIs such as JavaScript."