Which browsers do support HttpOnly cookies?

Question

Which browsers do support HttpOnly cookies, and since which version?

Please see http://www.codinghorror.com/blog/archives/001167.html for a discussion of HttpOnly cookies and XSS-prevention.

Mohler

Answer 1

Feel free to add to this list:

• Internet Explorer since 6 sp1 (source, source)
• Firefox since 2.0.0.5 (source)
• Opera since 9.5 (possibly earlier) (source)
• Safari since 4 (source)
• Chrome since 1.0.154 (source)

Pazice

Thanks! Found this list which adds some info: owasp.org/index.php/HTTPOnly#Browsers_Supporting_HTTPOnly – Mohler

@Mohler : Link is case sensitive and/or has been modified: owasp.org/index.php/HttpOnly#Browsers_Supporting_HttpOnly – Weisler

Link for Chrome is dead (Page not found We're sorry, but we were unable to locate the page you requested.). – Parker

somebody should update this list again or is it obsolete now with https?? – Undistinguished

Answer 2

All major browsers support HttpOnly.

• Microsoft IE 5.0+
• Mozilla Firefox 1.0+
• Google Chrome
• Apple Safari
• Opera 8.0+

Boehmer

I don't think that's true--can you provide references? – Pazice

I've seen reports that "IE6 SP1" and "Firefox 2.0.0.5" "now support HttpOnly cookies", which leads me to believe that at least IE5 and Firefox 1 dont support it. – Siskind