Create a cookie with javascript (got a whole cookie string already from Set-Cookie header)

Question

I know this was asked before, but I have a little bit of a different situation:

I need to create a cookie with javascript with this 'Set-Cookie' string (got it from curl headers within PHP):

.SOMEAUTH=LONGRANDOMSTRINGDLSAKSD325KFASFCAK32LONGRANDOMSTRING; expires=Sat, 01-Feb-2014 11:11:25 GMT; path=/; HttpOnly

A cookie is supposed to be created with

document.cookie = <cookie string data>; 

right?

Everyone builds their cookies up with name, date and then that path=/ at the end as I see... I have the mentioned string as variable in javascript. If I do

document.cookie = data; 

where data is my string above, the cookie is not created (I should see it in browser resources right?)

What am I doing wrong? Should HttpOnly be there?

Thanks for any help - if I was unclear please ask for more info

Answer 1

Remove HttpOnly and it will work. Javascript cannot set HttpOnly due to its.. well nature. it is in fact http only.