How to check if .ASPXAUTH cookie exists with javascript

Question

I have a strange problem. I want to check if .ASPXAUTH cookie exists with javascript. I do it like this:

authx = document.cookie.indexOf(".ASPXAUTH" + "=");

and the 'authx' value is always -1. But if I tray to find some other cookie like:

foo = document.cookie.indexOf("bar" + "=");

it works. Is there some restriction between javascript and .ASPXAUTH cookie???

well, the first question would be : did you check that the cookie is there ? did you check with firecookie or something, to make sure the cookie is there ? — sirrocco
– sirrocco, Commented Nov 17, 2010 at 8:10

dani · Accepted Answer · 2010-11-18 07:52:08Z

2

I solved it. The problem was, that I had set the

HttpOnly = true;

which prevents the javascript accessing the cookie. I just set it to false and it works.

answered Nov 18, 2010 at 7:52

dani

4693 gold badges12 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Troy Hunt Over a year ago

And of course it's meant to be HTTP only in order to avoid the risk of an XSS flaw grabbing your cookie and allowing your session to be hijacked. You've now opened up a vulnerability in your app.

d.popov Over a year ago

Where did you set that? JS ?

Dr TJ Over a year ago

@d.popov Obviously no!, You can set that in your web.config or (in asp.net mvc) as an attribute for each action method

d.popov Over a year ago

@DrTJ - maybe for you, but not so obvious for someone reading the question. Neither the question, tags or the answer suggests so. The question even suggests JavaScript context!

Collectives™ on Stack Overflow

How to check if .ASPXAUTH cookie exists with javascript

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related