Query about accessing HttpOnly Cookie & Secure coo

Question

I am working on RESTful SPA app using angularJS. Currently initial REST call is setting a "token" cookie on xyz.com ( secured response cookie) after successful user login. I am not able to read this cookie in Javascript/angular as I am working on localhost.

What I understood here , unless I run this app from xyz.com , i wont be able to access this cookie OR do I need a secured connection ?

Is my Understanding correct ?

Secondly, my understanding about "httponly" cookie is that , it wont be accessible from javascript even though you are on same host.

Please correct my understanding.

Answer 1

As the author of a website:

• You cannot read a cookie for a different site (ever)
• You cannot read an HTTP Only cookie with JavaScript
• You cannot read a Secure cookie unless it is served over HTTPS

That's three separate conditions, with independent effects, and none, some or all of them can apply to any given cookie.

Therefore if a cookie is secure and for a different site then you can't read it no matter if you use HTTPS or not (since different site blocks you even if secure does not).