Comparison
HttpOnly cookievsSession cookie
HttpOnly cookie
the session cookie is invisible to `document.cookie`, so a script that gets injected cannot read it.
A cookie flag that hides the value from JavaScript entirely, leaving it usable only by the browser when making requests. Together with `Secure`, which restricts it to HTTPS, it is the reason session tokens belong in cookies rather than in `localStorage`. It limits the damage from XSS without preventing it: injected script can still make authenticated requests as the user, it just cannot exfiltrate the token.
Full entry →Session cookie
you give the browser an opaque id and keep the actual session state on the server, so logging someone out is one delete.
An identifier referencing server-held session state. Revocation is immediate and the client learns nothing, which is exactly what stateless tokens give up. The cost is a lookup per request and shared session storage across instances; the flags — `HttpOnly`, `Secure`, `SameSite` — are what make it safe in a browser.
Full entry →