How to fetch HttpOnly cookie value in LWC?

Question

We have 3rd party Non-SF apps that uses Salesforce Credential as Oauth provider. When we hit 3rd party application login link, it navigates to Community login page.

Requirement : I want to add expid in out experience portal login page to detect the 3rd party application name.

Below is the link to extend Endpoint with Experience Id:

https://help.salesforce.com/s/articleView?id=sf.external_identity_dynamic_extend_endpoint_expid.htm&type=5

and after doing inspect element, our 3rd party Non-SF application shows below URL.

site-url/services/oauth2/authorize/expid_value

I tried to pass "appName" as value directly as below and it works.

e.g. site-url/services/oauth2/authorize/expid_appName

Now, In Broswer cookies it shows value as below and this value is something I want to fetch.

I tried to use document.cookie in LWC but it seems Javacript do not fetch the cookies which are HttpOnly.

LWC JS:

import { LightningElement,api } from 'lwc';

    export default class DisasterNotifications extends LightningElement {
        connectedCallback(){
            this.getCookie();
        }
        
        getCookie() {
            var tr = this.retriveCookie();
            if(tr != ''){
                this.cookieVal = JSON.parse(tr);
            } else{
                this.cookieVal = [];
            }
             
            console.log('Cookie val:'+this.cookieVal);
        }
     
        retriveCookie(){
            const cookieName = 'expid_appName';
            var cookieString = "; " + document.cookie;
            var parts = cookieString.split("; " + cookieName + "=");
            return decodeURIComponent(parts.pop().split(";").shift());
        }
    }

Based on below link I even tried to create a VF page but there is no option to add VF page component to Community Login page and my Community login page uses standard login page component(dont want to build custom login page).

https://help.salesforce.com/s/articleView?id=sf.external_identity_dynamic_with_custom_login_page.htm&type=5

I also tried to pass VF page variables to LWC via Aura app but again there is no option to add Aura app to Community Login page.

There is no clear information from below links where I can fetch HttpOnly cookies value directly in LWC.

Can someone please suggest how can I fetch HttpOnly cookie in LWC? Any other possible options is also fine.

Answer 1

What you're trying to do isn't possible. The point of HttpOnly is to prevent this type of cookie reading. If it were that easy to circumvent, it wouldn't be a very useful security feature. You'll have to go with a custom login page if you want to be able to do this.