5

Using Internet Options I can see all persistent cookies, and using Developer Tools I can see all JS-accessible session cookies. There does not seem to be a way to view HTTPOnly session cookies.

In Firefox there are many options, both built-in and with Firebug, to view cookies, including being able to see the request/response headers. Is there no way in IE8 to see HTTPOnly session cookies?

Related questions (no solutions for HttpOnly): IE7 IE8

Community
  • 1
  • 1
OrangeDog
  • 36,653
  • 12
  • 122
  • 207
  • http://blogs.msdn.com/b/jpsanders/archive/2009/06/04/understanding-the-new-wininet-flag-internet-cookie-httponly.aspx – Vrashabh Irde Aug 04 '13 at 17:15
  • any reason why you wouldn't use IE10 set to IE8 mode? Or is there a reason you believe IE8 isn't handling your specific session cookie the right way? – Spork Aug 06 '13 at 17:13
  • Because I don't have IE10, and many people who's sessions I debug also don't. – OrangeDog Aug 07 '13 at 08:34

1 Answers1

2

Check this out: http://blogs.msdn.com/b/jpsanders/archive/2009/06/04/understanding-the-new-wininet-flag-internet-cookie-httponly.aspx

There are a couple of new Cookie flags introduced with the Internet Explorer 8 WinInet.dll. The INTERNET_COOKIE_HTTPONLY flag allows you to read the HttpOnly cookies in your WinInet Code. This flag is documented here: http://msdn.microsoft.com/en-us/library/aa384714(VS.85).aspx.

and here's a way to build a tool and use this: http://www.codeproject.com/Articles/38616/Retrieve-HttpOnly-Session-Cookie-in-WebBrowser

Off the IE8 shelf not sure I see a way to retrieve HTTPOnlyCookies, since the dev tools seems to show only non HTTPOnly cookies. If you want to use a tool, use Fiddler2 and set response type to HTTPOnly.

Vrashabh Irde
  • 14,129
  • 6
  • 51
  • 103