How to read a HttpOnly cookie using JavaScript

Question

EDIT

What one means by "a secure cookie" is ambiguous. To clarify:

1. Secure as in sent over the https:// protocol — ie. cookie is not sent in plaintext. Known as the "secure flag"

2. Secure as in the cookie cannot be read by Javascript running in the browser — ie. document.cookie will not work. Known as the "HttpOnly" flag.

This edit is to clarify that the original question is asking about the 2nd case.

---

Original Question

Is there any way to read a secure cookie with JavaScript?
I tried to do it using document.cookie and as far as I can see on this article about secure cookies and HttpOnly flag , I cannot access a secure cookie this way.

Can anyone suggest a workaround?

Answer 1

Different Browsers enable different security measures when the HTTPOnly flag is set. For instance Opera and Safari do not prevent javascript from writing to the cookie. However, reading is always forbidden on the latest version of all major browsers.

But more importantly why do you want to read an HTTPOnly cookie? If you are a developer, just disable the flag and make sure you test your code for xss. I recommend that you avoid disabling this flag if at all possible. The HTTPOnly flag and "secure flag" (which forces the cookie to be sent over https) should always be set.

If you are an attacker , then you want to hijack a session . But there is an easy way to hijack a session despite the HTTPOnly flag. You can still ride on the session without knowing the session id. The MySpace Samy worm did just that. It used an XHR to read a CSRF token and then perform an authorized task. Therefore, the attacker could do almost anything that the logged user could do.

People have too much faith in the HTTPOnly flag, XSS can still be exploitable. You should setup barriers around sensitive features. Such as the change password filed should require the current password. An admin's ability to create a new account should require a captcha, which is a CSRF prevention technique that cannot be easily bypassed with an XHR .

Answer 2

The whole point of HttpOnly cookies is that they can't be accessed by JavaScript.

The only way (except for exploiting browser bugs) for your script to read them is to have a cooperating script on the server that will read the cookie value and echo it back as part of the response content. But if you can and would do that, why use HttpOnly cookies in the first place?

Answer 3

You can not. Httponly cookies' purpose is being inaccessible by script.

Answer 4

One of the ways is to use safari web inspector, and in storage tab you can see all cookies, httpOnly or not, and just select the cookie Command+C, to copy it.

Once you have the string you can easily parse it back with any cookie parser or plain javascript.

Answer 5

Going straight to your question, CanActivate or RouteGuard is not a must to prevent user from navigating to Admin routes because of the nature of cookie based auth. You first have to login in order to get the cookie, if your domain and credentials checkouts, the next request will be the user with the credentials set to true. If the cookies matches, the user data will be returned, otherwise will be an error (unauthenticated 401). All you have to do is check for the user, after subscribe, if you fall into next, then they can proceed, if they fall in error then they will be redirected to login.

The scenario above assumes that you have two layout components, one for Admin and another for public. The AdminLayout component will contain the router-outlet for all the children routes under admin. When you login, if you succeed, you are redirected to the dashboard or home. To get to the dashboard, you have to go through AdminLayout, once you get to AdminLayout you get the user, if you succeed, move on, if not, return to login.

As final remark, Cookie Auth is not more secure than JWT toke, everything has advantage and disadvantages.