javascript document.cookie missing some pairs

Question

My script set up ten cookies and the browser successfully saved them, but document.cookie only retrieves nine pairs, the missing pair is as follow:

auth:4ae9Mq1j6tjt7dV6kV6A0piHB6NnNjijBmecax9mA8cfDpSs6pnAcD7H1%2FUqWMIIB%2BbgtKIJ2w1L2GnXkgV2

What happened? Is there a character limit in document.cookie? The cookie domain is the same as all the others.

Answer 1

The problem is that the server side is sending the cookies with the HttpOnly setting as described here: http://en.wikipedia.org/w/index.php?title=HTTP_cookie#HttpOnly_cookie

Cookies sent this way are not accessible thru document.cookie. This is generally used to help protect the cookie value against possible XSS attacks on your site.

You didn't mention which technology you're using on the server side to set the cookies. In case you're using PHP, this link lists the possible ways the HttpOnly flag could be set:

https://www.owasp.org/index.php/HttpOnly#Using_PHP_to_set_HttpOnly