为什么我不能在客户端的GWT中获得JSESSIONID cookie？

Question

I have my GWT code in an index.jsp page, and when I view the page info (security/cookies), I see the JSESSIONID cookie assigned to 'subdomain.mysite.com'.

When in my client-side code, I do this:

Window.alert("cookies=" + Cookies.getCookieNames().toString);

I see two cookies that are assigned to 'mysite.com', but I do not see the JSESSIONID. The current url for the page is 'subdomain.mysite.com' - shouldn't it be giving me the cookie? When I refresh, or display the cookies on a click event, I still do not see the JSESSIONID cookie.

Why can't I get it on the client side?

Answer 1

Is your application server configured to set the HTTPOnly flag on the JSESSIONID cookie? If so, client side code will not be able to see it

See https://www.owasp.org/index.php/HttpOnly

It is generally good security practice to set the HTTPOnly flag - can you clarify why you want access to the JSESSIONID cookie in your client side code?

Answer 2

That will indeed happen if the HTTPOnly flag is set on the cookie, as explained by Chi. If your sole purpose is to get the current session ID in JavaScript context, then you could just let JSP/EL print it as if it's a JS variable:

<script>var jsessionid = '${pageContext.session.id}';</script>