Use HttpOnly Session Cookies for Improved Storefront Security

When you enable HttpOnly session cookies, the storefront stores Shopper Login and API Access Service (SLAS) access and refresh tokens as HttpOnly cookies instead of local storage. The server-side SLAS proxy layer handles token injection transparently. Only browsers can read and send HttpOnly cookies. JavaScript code that runs on the page can’t access them. Using HttpOnly cookies prevents client-side scripts from exploiting the storefront and makes the storefront more secure.

PWA Kit version 3.19 or later. See the pwa-kit GitHub repository.

For more information about HttpOnly cookies and how to configure them in composable storefronts, see pwa-kit GitHub: HttpOnly Session Cookies — Architecture. For more information about HttpOnly cookie storage, see pwa-kit GitHub: HttpOnly Mode: SLAS Property Storage Mapping.