Does the HTTPOnly cookie straight up denies JS in XSS access to all cookies?

@JohnZhau Go try and find out! Note that from the browser's perspective there is no such thing as XSS. It is all just JavaScript.

It won't throw any errors though. The cookies simply don't exist.

I've tried checking the cookies on a certain site. Using Firefox's dev console, running document.cookie returns nothing, but in Python, making a request r = requests.get(url) and checking the cookies with r.cookies returns a cookie. Is that just Firefox' console not giving the cookies from 1 request or JS blocked from the cookies?

@JohnZhau The behavior you some form the Firefox console is exactly what you should expect. Keep in mind that the HTTPOnly flag really only affects browsers, because it is only meant to stop JavaScript from accessing the cookies. Therefore it makes perfect sense for you to be able to read the cookies from the python requests library

You never realize how amazing a competent sales account manager is until you have to start working with somebody who doesn't quite grasp how the licensing is supposed to work.

One of our suppliers had a shake up a few months ago and I have not yet had a purchase from them since where I didn't have to tell the account manager that the wrong items are on the quote.