I work on Demandware platform, and use dw.web.Cookie class. there is no way to add HttpOnly attribute to the new Cookie.

Do we have any solution or workaround?

1 Answer 1


No, I'm afraid not. Per the documentation, Require HttpOnly atrribute:

Restricts session ID cookie access. A cookie with the HttpOnly attribute is not accessible via non-HTTP methods, such as calls from JavaScript.


If you have a custom or packaged application that uses JavaScript to access session ID cookies, selecting Require HttpOnly attribute breaks your application. It denies the application access to the cookie. If Require HttpOnly attribute is selected, the AJAX Toolkit debugging window isn’t available.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .