2026-11-06 · Daily security tips

Can a script on your page read the login cookie?

Cookies marked HttpOnly cannot be read by JavaScript. If yours are not, any XSS on your page can copy the session and act as that user.

Check: open DevTools, Application (or Storage) > Cookies for your domain. Look at the HttpOnly and Secure columns for the session cookie (often sb-*-auth-token, next-auth.session-token, or __session). If HttpOnly is blank, page scripts can read it. If Secure is blank, it can travel over plain HTTP.

Fix: set the session cookie with HttpOnly and Secure (and SameSite=Lax or Strict). In Supabase SSR and NextAuth this is the default when you use their cookie helpers; custom auth that writes document.cookie by hand often misses both flags.

Found HttpOnly off? Sign everyone out after you flip it, so old cookies die.