<!--
{
  "availability" : [
    "iOS: 2.0.0 -",
    "iPadOS: 2.0.0 -",
    "macCatalyst: 13.1.0 -",
    "macOS: 10.2.0 -",
    "tvOS: 9.0.0 -",
    "visionOS: 1.0.0 -",
    "watchOS: 2.0.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "Foundation",
  "identifier" : "/documentation/Foundation/HTTPCookie/isHTTPOnly",
  "metadataVersion" : "0.1.0",
  "role" : "Instance Property",
  "symbol" : {
    "kind" : "Instance Property",
    "modules" : [
      "Foundation"
    ],
    "preciseIdentifier" : "c:objc(cs)NSHTTPCookie(py)HTTPOnly"
  },
  "title" : "isHTTPOnly"
}
-->

# isHTTPOnly

A Boolean value that indicates whether the cookie should only be sent to HTTP servers.

```
var isHTTPOnly: Bool { get }
```

## Discussion

The value of this property is <doc://com.apple.documentation/documentation/Swift/true> if the cookie should only be sent using HTTP headers, <doc://com.apple.documentation/documentation/Swift/false> otherwise.

Cookies can be marked as HTTP-only by a server (or by JavaScript code). Cookies marked as such must only be sent via HTTP Headers in HTTP requests for URLs that match both the path and domain of the respective cookies.

> Note:
> [RFC 6265](https://tools.ietf.org/html/rfc6265) formally defines the `HttpOnly` attribute.

> Important:
> To prevent cross-site scripting vulnerabilities, don’t deliver cookies marked as HTTP-only to JavaScript code.

---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)