A city session cookie is missing the HttpOnly flag. In an XSS discussion, why does that matter?
Select an answer to reveal the explanation.
Short Explanation
HttpOnly is the “scripts keep their hands off this cookie” latch. Without it, a successful XSS can often read the session cookie directly. That flag does not magically invent Secure or kill all JavaScript on the site — it just changes how bad XSS can get for the session.
Full Explanation
The HttpOnly cookie attribute instructs browsers not to expose the cookie to document.cookie and similar script access. When it is absent and XSS exists, attackers may steal session identifiers more easily, raising impact. HttpOnly does not by itself enable Secure, survive upgrades only, or disable all JavaScript. XSS findings should call out missing HttpOnly as an impact amplifier for session cookies.