AngularJS: Can not read session value

Question

The session is set by server when the user logs in

I want to retrieve this value in my angular front end, but it says undefined

The relevant code is

   $scope.logout = function () {
        console.log('session value', $cookieStore.get('session'));
    }

and my app is also configured to include ngCookies

var app = angular.module('myApp', ['ngCookies']);

when I run my application, i see

session value undefined

I can however, see the session in Chrome Dev Tools

enter image description here

What is that I am missing?

Darin Dimitrov · Accepted Answer · 2013-09-15 16:23:58Z

27

What is that I am missing?

The server set the cookie as Session cookie (HttpOnly flag). This means that you cannot access this cookie on the client. The client will send the cookie to the server on each request but the client has no access to its value. That's the very definition of an HttpOnly cookie. If you want to be able to access this cookie value on the client you should modify your server side script so that when it is setting the cookie it doesn't append the HttpOnly flag to it. Obviously this comes with the corresponding disclaimer about the security vulnerability that you might be opening on your site depending on the purpose and specific value stored in this cookie.

answered Sep 15, 2013 at 16:23

Darin Dimitrov

1.0m275 gold badges3.3k silver badges3k bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

daydreamer Over a year ago

what if i want to remove this session, because that ways I can logout my user, do you have any ideas on that? Plus, THANK YOU very much because I learned something new today

Darin Dimitrov Over a year ago

As I explained in my answer you cannot use javascript to access cookies that are set with the HttpOnly flag on the server. That's the very definition of those cookies. Only the server can access them. So you should either modify your server side script so that it doesn't emit this cookie with the HttpOnly flag or send an AJAX request to the server and the server will take care of removing the cookie value to log the user out.

Shashank Hegde Over a year ago

Dude I Love You. I was scratching my head and was about to bang my laptop. I was working on this from past 1 week and was not able to figure out. None of them gave perfect answer. You are the Guy!! Cheers. I use Django at my backend and there, 'SESSION_COOKIE_HTTPONLY = True'. I figured this out.

oyilmaztekin Over a year ago

I am stuggling with the same issue @DarinDimitrov . Thanks. your answer was illuminating. But one thing I didn't understand. When I POST user data with CURL on the terminal it responsed the session value like Set-Cookie: session=.eJwdjsGKwjAURX9leGs... I will be appriciate if you explain it how? Curl request response the session data, but http request does not.

Ivan Aranibar · Accepted Answer · 2016-11-08 20:56:02Z

1

UPDATE

It is worth noting that $cookieStore is deprecated and now for accessing the cookies one should use ngCookies (see ngCookies).

answered Nov 8, 2016 at 20:56

Ivan Aranibar

2,2962 gold badges18 silver badges22 bronze badges

Collectives™ on Stack Overflow

AngularJS: Can not read session value

2 Answers 2

4 Comments

UPDATE

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

UPDATE

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related