Logout with HttpOnly cookie

问题:

I can see that HttpOnly cookies are good for security, however they make logging out without server interaction impossible, right?¹ So when the network fails, you can't log out and leave. I can imagine a workaround, but I'd like to ask first

• does it make sense to handle this case
• are there any standard solutions for this?

^{1 Assuming you're actually using them.}

回答1:

If by logging out you mean removing the session cookie, then no, you cannot remove HttpOnly cookies from Javascript. It is, however, easy to set up two cookies, one HttpOnly and one insecure, such that only a combination of the two is a valid session key. Removing either cookie would destroy the session.

If your service is sensitive, it does make sense to handle all realistic threat scenarios, and this one is pretty realistic.

Setting up two cookies, one of which is HttpOnly, is actually common in the standard CSRF prevention technique. I have not seen it in your specific scenario but it very similar to the anti-CSRF case, and looks like an obvious and easy application of the general twoo-cookies idea.