The browser's way of presenting the owner token.
A page cannot set an Authorization header on its own navigation, so the cookie carries the token itself (no session id, which would need its own row and expiry). HttpOnly keeps it away from page script.
Authorization
HttpOnly
The browser's way of presenting the owner token.
A page cannot set an
Authorizationheader on its own navigation, so the cookie carries the token itself (no session id, which would need its own row and expiry).HttpOnlykeeps it away from page script.