title: Are my cookies really HTTP only? Flag is absent in Cookie request header
body: <p>Ive made some configurations to (finally) have my cookies set on HTTP only.</p>
  
  <p>"Seem" to work.</p>
  
  <p>Ive tried them with <a href="http://www.getpostman.com/" rel="nofollow noreferrer">postman</a> and I have the following:</p>
  
  <p>When I hit the login page:</p>
  
  <p>On the cookies section, my cookie with name JSESSIONID appears to be HTTP only (it has the check)</p>
  
  <p>When I enter to the logged area , the same result...</p>
  
  <p>The headers dont give me more details.</p>
  
  <p>Then,</p>
  
  <p>I check it with google chrome. I open the developers toolbar.</p>
  
  <p>I load the login page.</p>
  
  <p>At the headers on the response headers I get </p>
  
  <pre><code>Set-Cookie: JSESSIONID=434434..... HttpOnly
  </code></pre>
  
  <p>So, its fine (I guess).</p>
  
  <p>Then I reload the page (or sign in).</p>
  
  <p>Then the problem:</p>
  
  <p>No response headers received.</p>
  
  <p>The <strong>Request Headers</strong> brings my cookie (with the same ID at then the previous one) without the httponly, host info or any other cookie value I set before.</p>
  
  <p>At the cookies tab I get Request Cookies only and no Response cookie.</p>
  
  <p>And the request cookie is non http-only</p>
  
  <p><a href="https://i.stack.imgur.com/oAEMz.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/oAEMz.png" alt="enter image description here"></a></p>
  
  <p>At my resources tab, the Cookie is there, as HTTP only and with the previous values I set.</p>
  
  <p>My question now is... Is it a really http-only cookie? Or my configuration is not properly set?</p>
  
  <p>Should I always get the response cookie or the request cookie should be always http-only (In case I am trying to set it as http-only) or is this behavior normal (or at least accepted) ? </p>
  
  <p>When I try to print my cookie with Javascript at both scenarios I get a null as response (what makes me think then it is correct).</p>
  
  <p>Ideas?</p>