---
schema_version: "1"
id: 1430bd2e047115706b08d76c272f0bd039fa643e85036962170be9f258631632
title: Use HttpOnly Session Cookies for Improved Storefront Security
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/pwa-kit-managed-runtime/guides/pwa-httponly-cookie.md
canonical_url: https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/pwa-httponly-cookie.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 122f113cc7243c5922f046a1b2aef1eb5c0d5a844cf2119770017c22d9a7ad37
products:
  - Composable Storefront
  - Salesforce APIs
---
# Use HttpOnly Session Cookies for Improved Storefront Security

When you enable HttpOnly session cookies, the storefront stores Shopper Login and API Access Service (SLAS) access and refresh tokens as HttpOnly cookies instead of local storage. The server-side SLAS proxy layer handles token injection transparently. Only browsers can read and send HttpOnly cookies. JavaScript code that runs on the page can't access them. Using HttpOnly cookies prevents client-side scripts from exploiting the storefront and makes the storefront more secure.

## Prerequisite

PWA Kit version 3.19 or later. See the [pwa-kit](https://github.com/SalesforceCommerceCloud/pwa-kit) GitHub repository.

For more information about HttpOnly cookies and how to configure them in composable storefronts, see [pwa-kit GitHub: HttpOnly Session Cookies — Architecture](https://github.com/SalesforceCommerceCloud/pwa-kit/blob/develop/docs/httponly-cookies-architecture.md). For more information about HttpOnly cookie storage, see [pwa-kit GitHub: HttpOnly Mode: SLAS Property Storage Mapping](https://github.com/SalesforceCommerceCloud/pwa-kit/blob/develop/docs/httponly-storage-mapping.md).