SecurityIntermediate
HttpOnly cookie
Also known as HTTP-only cookie · HTTP only cookie
A cookie marked HttpOnly so browser JavaScript cannot read or change it through APIs such as document.cookie.
In the real world
Set-Cookie: session=opaque-id; HttpOnly; Secure; SameSite=Lax; Path=/
