27

I can see that HttpOnly cookies are good for security, however they make logging out without server interaction impossible, right?1 So when the network fails, you can't log out and leave. I can imagine a workaround, but I'd like to ask first

  • does it make sense to handle this case
  • are there any standard solutions for this?

1 Assuming you're actually using them.

maaartinus
  • 44,714
  • 32
  • 161
  • 320

1 Answers1

42

If by logging out you mean removing the session cookie, then no, you cannot remove HttpOnly cookies from Javascript. It is, however, easy to set up two cookies, one HttpOnly and one insecure, such that only a combination of the two is a valid session key. Removing either cookie would destroy the session.

If your service is sensitive, it does make sense to handle all realistic threat scenarios, and this one is pretty realistic.

Setting up two cookies, one of which is HttpOnly, is actually common in the standard CSRF prevention technique. I have not seen it in your specific scenario but it very similar to the anti-CSRF case, and looks like an obvious and easy application of the general twoo-cookies idea.

n. m. could be an AI
  • 112,515
  • 14
  • 128
  • 243
  • so i can generate two tokens with same payload data using two secret keys, would that enough to secure the api. – varaprasadh Sep 20 '21 at 11:56
  • @varaprasadh I think his saying store half of the auth token in each key so that if either is compromised then your still safe because they only have half of the access token. – boredProjects Oct 03 '22 at 19:56