# Request to use HttpOnly Cookies for Auth0 Authentication

**URL:** <https://community.auth0.com/t/request-to-use-httponly-cookies-for-auth0-authentication/98646>\
**Category:** Get Help\
**Tags:** classic-universal-login-experience, login-experience\
**Created:** [January 22, 2023, 10:13am UTC](https://community.auth0.com/t/request-to-use-httponly-cookies-for-auth0-authentication/98646 "2023-01-22T10:13:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Insighting](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/insighting/32/12814_2.png) [@Insighting](https://community.auth0.com/u/Insighting)\
**Post date:** [January 22, 2023, 10:13am UTC](https://community.auth0.com/t/request-to-use-httponly-cookies-for-auth0-authentication/98646/1 "2023-01-22T10:13:10Z")

</div>

Dear Auth0 Support Team,

I am writing to inquire about the possibility of using HttpOnly cookies for authentication in my application that uses Auth0. I understand that Auth0 currently uses a combination of both HttpOnly and Secure cookies for authentication and session management.

I am interested in using HttpOnly cookies as an additional layer of security to prevent cross-site scripting (XSS) attacks and to be compliant with certain regulations. I understand that HttpOnly cookies are only accessible via the HTTP protocol and cannot be accessed or modified by client-side scripts.

I would appreciate it if you could let me know if it is possible to use HttpOnly cookies instead of the current Secure cookies for authentication in my application. If so, could you please provide me with any necessary steps or guidelines for implementing this change?

Thank you for your time and assistance.

Best regards,  
Avi Cohen

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [February 9, 2023, 10:27pm UTC](https://community.auth0.com/t/request-to-use-httponly-cookies-for-auth0-authentication/98646/4 "2023-02-09T22:27:02Z")

</div>

Hey there @Insighting welcome back!

Setting cookies to `HttpOnly` would prevent JavaScript from reading the value. If you are building a SPA application for example, JS must have access to these values.

If this is a requirement for your application you may need to move your authentication to a backend which would allow for the use of HttpOnly cookies and sessions as needed.

Hope this helps!

---

<div class="post-metadata">

**Author:** ![Insighting](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/insighting/32/12814_2.png) [@Insighting](https://community.auth0.com/u/Insighting)\
**Post date:** [February 15, 2023, 8:49am UTC](https://community.auth0.com/t/request-to-use-httponly-cookies-for-auth0-authentication/98646/5 "2023-02-15T08:49:05Z")

</div>

Thank you Tyf,

We are currently using Auth0 for authentication in our application, and we want to ensure that our users’ data is as secure as possible. can you kindly help us with additional info:  
What information do these security cookies typically hold?  
What are the security risks in case these cookies are hacked?

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [April 29, 2023, 12:18am UTC](https://community.auth0.com/t/request-to-use-httponly-cookies-for-auth0-authentication/98646/6 "2023-04-29T00:18:37Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.