Cookie with HttpOnly flag for a angularJs application on Https protocol

Question

I have a Angular Js application with uses https protocol for communication with server. I use cookie to store the logged in user's name and jwt token. Below is the code I use to set the cookie.

    $cookies.putObject('token', token, {
        expires: exp,
        secure: true
      });

In order to get clearance for my application from Security Team, I need to set the HttpOnly flag for cookie.

When i open the cookies of my website I see two items

1. connect.sid - Not sure how this gets created. I am not doing anything explicit to create this cookie.
2. token - This is the cookie i create to store the user and his jwt token.

I googled up and did the necessary changes to set the HttpOnly flag on these cookies. And it worked, i could see both the cookies had HttpOnly flag checked. But after this change my authentication stopped working (i.e im not able to access the jwt set inside the cookie). In other words my communication with the back-end is broken. I use below statement to read the cookie.

$cookies.getObject('token')

I had to revert some changes to get back to previous state. Right now, connect.sid cookie is set with HttpOnly flag and token cookie is not. Im wondering what must be the issue here. Im new to Angular Js and have never worked on Cookie management before. Any help will be greatly appreciated.

Answer 1

A HttpOnly cookie means that it cannot be accessed from scripting languages like JavaScript. So there's in JavaScript absolutely no API available to get/set the HttpOnly attribute of the cookie, as that would otherwise defeat the meaning of HttpOnly.

Just set your 'token' cookie from the server.