What should be the correct behaviour of browser when sending and receiving httponly cookie via ajax?

Question

I currently have an issue with Firefox where it receives a cookie with httponly flag. However when a subsequent response is sent to the server the request does not contain any httponly flag (which may be correct behaviour), however when the response comes back down it returns the cookie however it does not have the httponly flag attached, as I assume it is returning it in the same state it got it.

So is this correct behaviour? should I be manually updating the httponly state of the cookie on the server for each request? or should the httponly state be persisted between calls? I am sure there may be some different behaviour per browser but just assume modern mainstream browsers.

Wyatan

Why should the browser send flags along with cookies? Also, since you mentioned AJAX, why should Javascript have knowledge about the cookie whose HttpOnly attribute indicates the intent to hide it from javascript? – Geometer

It shouldn't, the whole point of HTTPOnly is that you cannot access it in JS. The query here was if the server had to perpetually set the HTTPOnly flag on subsequent responses, which it does. – Wyatan

I noticed the same behaviour from a .Net service (I did not see its source code), as if the service code ignores presence of the cookie in the request and replies with the cookie by the same name and value. In addition to ignoring the cookie in the request, this somehow ignored the service's own web configuration instructing to add "; HttpOnly; Secure" to each cookie. This overwrites the cookie in the browser, according to par. 11 of section 5.3 [Browser] Storage Model, HTTP State Management Mechanism, tools.ietf.org./html/rfc6265#section-5.3. – Geometer

Answer 1

A few moments after sending this I found:

Understanding the intended behaviour of HTTPOnly flag

which indicates that this is correct behaviour and the server has to continually append the httponly flag. Seems a bit wacky, but hey as long as I know what the intended behaviour is.

Wyatan

The current answer to the linked question implies the opposite. I agree with the author of the original question suspecting a bug in the server which dropped the flags. The flags must always be present in Set-Cookie. In addition, I see no purpose in the server re-sending the same cookie. – Geometer