Since wordpress is setting all its cookie for httponly so I seek help from the following thread and get it done. And I can use wordpress login process  for my new
theme authority check when they are going or logging to my new theme


http://www.experts-exchange.com/Programming/Languages/Scripting/JavaScript/Q_28215476.html#a39417001

My question is only 2

1- If the user already have authority right to access wordpress login page and the cookie is
stored in its browser, why it is still using httponly for his cookies ?
I thought there is no different httponly true or false becoz he is already given auth right
and cookie to store in his browser

What is benefit we can get from httponly for security ? and I have
seen in google search, httponly is leakage or no use for security logging into page, Why ?


2- I have seen a lot of website , they are using periodical function or ajax, for example,
1 time in 1 minute(1/per min) to refresh the current page  in order to
keep the current page auth right,for example, wordpress/wp-admin/admin-ajax.php,  Why, is it needed ?


Please advise

Duncan

hello duncanb7, , there are several things you should know about web cookies, learning what and how they are set up and handled in web browsers. The way you are asking your questions about web cookies, may not get you an answer here, that lets you know what you are wondering about.
Here is an informative page at WIKI about web cookies -
http://en.wikipedia.org/wiki/HTTP_cookie

some to consider from that WIKI -
"Cookies were designed to be a reliable mechanism for websites to remember stateful information stored in a browser"
"Perhaps most importantly, authentication cookies are the most common method used by web servers to know whether the user is logged in or not"

"HttpOnly cookie
The HttpOnly cookie is supported by most modern browsers.  On a supported browser, an HttpOnly session cookie will be used only when transmitting HTTP (or HTTPS) requests, thus restricting access from other, non-HTTP APIs like JavaScript. This restriction mitigates but does not eliminate the threat of session cookie theft via cross-site scripting (XSS). This feature applies only to session-management cookies, and not other browser cookies."

"Secure cookie
A secure cookie has the secure attribute enabled and is only used via HTTPS, ensuring that the cookie is always encrypted when transmitting from client to server. This makes the cookie less likely to be exposed to cookie theft via eavesdropping. This is different than a  httpOnly cookie!"

= = = = = = = = = = = = = =

you ask -
1- If the user already have authority right to access wordpress login page and the cookie is
stored in its browser, why it is still using httponly for his cookies ?
       This is an attempt for security, to keep a web page javascript from getting and sending-using a "Session" or "Login" cookie, it is suppose to prevent javascript XSS (cross-site scripting ), where some inserted script (from a  user in a forum or blog comment post from page form) reads the session cookie and sends it to another server to use "improperly" to get into that account with the cookie credentials.
Here is a WIKI with info about this -
http://en.wikipedia.org/wiki/Cross-site_scripting
    From that page -
"By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the user. "

- - - - - -
also ask -
"2- I have seen a lot of website , they are using periodical function or ajax, for example,
1 time in 1 minute(1/per min) to refresh the current page  in order to
keep the current page auth right,for example, wordpress/wp-admin/admin-ajax.php,  Why, is it needed ?"

Updating with Ajax may not have anything to do with the cookies, or security or session-time-outs ,  I do not know why the wordpress administration page get an ajax return every minute, it may just be updating the statistics about site hits or user posts, or changing information, But it can also make sure that your session does not "Time Out" if you are writting a new page and it takes more than 15 minutes of work  Some servers have session Time-Outs of 15 minutes from the last access of PHP Session, others have it set to a different amount, even if the session cookie lasts a year, the Session data is GONE if there is no session access ON THE SERVER in 15 minutes (or time set).

Some of the above information like preventing the insertion of script in blog comments should be dealt with in another question here, but I hope this give you some about cookies.
Why are you so concerned about the server side httponly cookies, I do not see that would be a problem in server side PHP code?

Please see http://php.net/manual/en/function.setcookie.php which seems to dispute the claim in this post.I read this differently.  HTTP-Only cookies can be used on HTTPS.  They are not supposed to be returned to JavaScript, but that is a decision of the browser and may not be 100% implemented, especially if the client is using a rogue browser.
* The HTTP protocol includes HTTPS.

With respect to PHP sessions, this article may be helpful.
http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/A_11909-PHP-Sessions-Simpler-Than-You-May-Think.html

If you have questions about how HTTP Client / Server protocols work in practice, this article should explain many of the important details.
http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/A_11271-Understanding-Client-Server-Protocols-and-Web-Applications.html

HTH, ~Ray

1) httponly = true means this cookie cannot be used on a secure site (one beginning with "https://").  This prevents a malicious user from falsifying login info and setting it in a cookie, for example, but that implies that you have your login page secured.  Just an example, there could be various reasons why you want to disallow cookies in HTTPS.

2) refreshing a page keeps the session alive.  If application stores information in session variables, then session timing out would lose that info.  Usually pages have some question to the user buit into the refresh, like "you have been inactive for a while, do you want to stay logged in?"  If user answers yes - page refreshes.  if they answer no (or do not answer within some specified period of time) - they are logged out and session is abandoned.  Session timeout value is specified at the server level.  it can be specified per-server or per-web application (website).