用javascript获取HttpOnly cookie

Question

do you know of any way to get access to HttpOnly cookies using javascript. I know that the point of those cookies is that you won't be able to get them this way (for security reasons). But still, is there absolutely now way to achieve this? Hasn't some hacker around the world found a way to achieve this? I really need to get those cookies through javascript (not any other means). If you know how, it would be very helpful. Thank you.

Answer 1

从javascript只有HttpOnly-cookies的加密版本可用，并且由于密钥是为每台计算机唯一生成的，因此不能在其他计算机上使用cookie（除非破解）。

Answer 2

No, if there were a way, it would be browser-specific, and probably be patched really soon. What you're looking for is a security hole, and won't last long once it's been discovered.

Answer 3

Its possible through applet or npapi plugin

Request the server for a connection,it will response with httpOnly cookie

Pass it to JavaScript from applet

Its a security hole that's why chrome and Firefox going to stop npapi support

Answer 4

I found a way to access an HTML-only cookie. Get the EditTThisCookie extension, then open the page you want. Click on the extension at the top (aka cookie) look for the cookie you want, click on it, then un-check the http only button, it is now accessible by document.cookie .

Answer 5

This is impossible to access HttpOnly cookies by javascript, but if you can remove HttpOnly flag from a cookie by an extension then the cookie will be accessible by javascript.

You can use EditTThisCookie extension as said by @Pipcit404, you should find your target cookie then change the HttpOnly to unchecked and apply it like bellow image:

It's a trick for testing by a developer who want to access the cookies in the developer tools and it is not a solution for end users.