Hacker News Reader

FTA:

> and session cookies don't default to http-only flags (allowing XSS attacks to steal them).

Can someone explain that to me?

Setting this flag on a cookie means it can't be accessed from JavaScript, so a malicious script won't be able to determine your session (for instance).

Take a look here: https://www.owasp.org/index.php/HttpOnly

Reply on news.ycombinator.com