I found this link

But at the bottom it says This information is likely no longer up to date. So my question is, will http_only cookies be sent with AJAX? Can the response via AJAX set http_only cookies?

Edit 1: Let's say an user logged in to the system. His session started and http_only cookie is set. He tries to fetch list of his friends via AJAX and sends JSON. When making the AJAX request, do I need to make anything special to say to send cookies or not? Will each request send the cookies to the server by default? Will the response send back cookies (let's say I am updating users' time for last activity)?

I found this link

But at the bottom it says This information is likely no longer up to date. So my question is, will http_only cookies be sent with AJAX? Can the response via AJAX set http_only cookies?

Edit 1: Let's say an user logged in to the system. His session started and http_only cookie is set. He tries to fetch list of his friends via AJAX and sends JSON. When making the AJAX request, do I need to make anything special to say to send cookies or not? Will each request send the cookies to the server by default? Will the response send back cookies (let's say I am updating users' time for last activity)?

• javascript
• php
• ajax
• cookies
• httponly

• you need to set the withCredentials option. – Daniel A. White Commented Dec 14, 2014 at 18:18

1 Answer 1

Yes, they will.

The HttpOnly makes cookies not appear in document.cookie and XMLHTTPRequest.getAllResponseHeaders. It doesn't prevent them from being sent with HTTP requests, with the exception of cross-domain HTTP requests (which it doesn't sound like you're using here).