HttpOnly cookie can be accessed in a node client? - node.js

Question

I'm new to node and going through some tutorials. I've got a simple node server running this code:
// SERVER CODE
const http = require('http');
const Cookies = require('cookies');
const port = 3000;
const requestHandler = (request, response) => {
cookies = new Cookies(request, response);
cookies.set("foo", "bar", { httpOnly: true });
response.end('Hello Node.js Server!');
}
const server = http.createServer(requestHandler);
server.listen(port, (err) => {
if (err) {
return console.log('something bad happened', err);
}
console.log(`server is listening on ${port}`);
})
And I have another .js file that tries to access this server:
//CLIENT CODE
const http = require('http')
http.get('http://machine_name:3000', (
console.log(res.headers['set-cookie']);
});
From my understanding, httponly cookies should be unable to be available by client Javascript. When I run the client code though, I get:
[ 'foo=bar; path=/; httponly' ]
Is this right? Am I not setting it up correctly? I feel like this is an error since the httponly property means I shouldn't be able to access it via Javascript.

Answer 1

What you are doing is doing it in the right way and this you can try with your browser.
Si tienes un archivo index con el siguiente contenido:
// index.js file
const http = require('http');
const Cookies = require('cookies');
const port = 3000;
const requestHandler = (request, response) => {
cookies = new Cookies(request, response);
cookies.set("foo", "bar", { httpOnly: true });
response.end('Hello Node.js Server!');
}
const server = http.createServer(requestHandler);
server.listen(port, (err) => {
if (err) {
return console.log('something bad happened', err);
}
console.log(`server is listening on ${port}`);
})
When you execute the command
node index.js
And you open your browser, open the console and execute the following
console.log( document.cookie ) // this not return your cookies
But if you have { httpOnly: false } you can get the following:
"other-cookies; foo=bar"
This is because JavaScript uses cookies more in the browser itself than in the console, if you have the httpOnly flag activated you can be 100% sure that no JS script can use it.
Read more about cookies