OWASPASVS 5.0 requirement
ASVS-V3.3.4 If the value of a cookie is not meant to be accessible to client-side scripts (such as a session token), the cookie must have the…
- Standard
- OWASP ASVS 5.0
- Chapter
- V3 Web Frontend Security
- Section
- V3.3 Cookie Setup
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that if the value of a cookie is not meant to be accessible to client-side scripts (such as a session token), the cookie must have the 'HttpOnly' attribute set and the same value (e. g. session token) must only be transferred to the client via the 'Set-Cookie' header field.