Why getting a cookie isn't working?

Question

This is driving me crazy! I have a cookie that was set from a response header that contains the sessionid. The cookie is visable in the dev tools in Chrome and in Firefox, but document.cookie returns an empty string.

The cookie looks like this:

Name: sessionid
Value: 123456789
Domain: app
Path: /
Expires: Session
Secure: No

The url I'm hitting is http://app/

Any ideas on why this I can't access this cookie through the DOM api?

Answer 1

Cookies that are marked httpOnly are not accessible from JavaScript in order to mitigate attacks that would steal session keys via XSS. The cookie you are looking for is probably marked with that.