The browser cookie attribute that prevents JavaScript from accessing the cookie is HttpOnly.
HttpOnly is a flag in a cookie’s Set-Cookie instruction. When it is present, the browser does not expose that cookie through client-side scripting, including JavaScript APIs such as document.cookie. The server can still receive the cookie through applicable HTTP or HTTPS requests.
This makes HttpOnly especially useful for session identifiers and other sensitive values. If a site suffers a cross-site scripting attack, the attacker’s script cannot simply read an HttpOnly session cookie and send its value elsewhere. The flag is a defense-in-depth measure, not a complete cure for cross-site scripting: malicious scripts may still perform actions as the victim within the page.
HttpOnly is commonly confused with Secure and SameSite. Secure limits transmission to secure connections, while SameSite controls when cookies accompany cross-site requests. Path limits the URL paths for which a cookie is sent; it does not block JavaScript access. These attributes can be combined for stronger cookie security.