Logout with HttpOnly cookie

Question

I can see that HttpOnly cookies are good for security, however they make logging out without server interaction impossible, right?¹ So when the netwo

Answer 1

If by logging out you mean removing the session cookie, then no, you cannot remove HttpOnly cookies from Javascript. It is, however, easy to set up two cookies, one HttpOnly and one insecure, such that only a combination of the two is a valid session key. Removing either cookie would destroy the session.

If your service is sensitive, it does make sense to handle all realistic threat scenarios, and this one is pretty realistic.

Setting up two cookies, one of which is HttpOnly, is actually common in the standard CSRF prevention technique. I have not seen it in your specific scenario but it very similar to the anti-CSRF case, and looks like an obvious and easy application of the general twoo-cookies idea.