4

I am trying to read all the cookies set by my domain using document.cookie what I have noticed is, it returns only csrftoken and another value. My goal is to read the sessionid from the cookie

please see the below screenshot that shows the cookies set on my local machine Cookies on my local machine

and this is the return value of document.cookie

document.cookie console output

sessionid cookie value in Request Headers

Santhosh
  • 891
  • 3
  • 12
  • 31

1 Answers1

11

_rbt_login_message and sessionid are likely HTTP-only cookies, meaning they can be read only by the server when it's handling a page request, and not by any client-side JavaScript code.

This is usually done for session identifying cookies, since you (as a developer) don't want client-side code (which can be injected by a malicious third-party relatively easily) to be able to steal the session of one of your users.

Frxstrem
  • 38,761
  • 9
  • 79
  • 119
  • 1
    How do I identify if they are HTTP-only cookies. In the HTTP response headers I only see `_rbt_login_message` in the `Set-Cookie` header. Please see the following screenshot http://i.imgur.com/FzN68NJ.png – Santhosh Sep 06 '16 at 19:38