Frontend & browser·Browser security
the session cookie is invisible to `document.cookie`, so a script that gets injected cannot read it.
HttpOnly cookie
Also calledHttpOnly, Secure cookie
A cookie flag that hides the value from JavaScript entirely, leaving it usable only by the browser when making requests. Together with `Secure`, which restricts it to HTTPS, it is the reason session tokens belong in cookies rather than in `localStorage`. It limits the damage from XSS without preventing it: injected script can still make authenticated requests as the user, it just cannot exfiltrate the token.