Javascript document.cookie always returns empty string

HttpOnly cookies cannot be accessed from Javascript and session cookies are usually set as HttpOnly cookies. See also this StackOverflow question:
How to read a secure cookie using JavaScript

So… check whether the cookie you want to read has the ‘HttpOnly’ flag set… If so, you know the culprit.
It’s not a bug, it’s a feature!

Leave a Comment