Layer HttpOnly cookies and CSP, but do not rely on them alone

OWASP lists CSP and cookie attributes as additional layers, not primary defenses. It helps to know what each one limits:

• HttpOnly session cookies stop injected script reading the cookie, but the script can still make requests as the user from their own browser. XSS is still account takeover in practice.
• A strict CSP stops most injected scripts from running at all. It does nothing for HTML injection that changes forms or content without script.
• Trusted Types blocks strings at DOM sinks, but only in browsers that support it.
• Sanitizers remove dangerous markup, as long as their output is not modified afterwards.

None of these replaces encoding output and avoiding raw sinks. Use all of them, so a mistake in one layer is caught by another.

A note on legacy headers: OWASP's HTTP Headers Cheat Sheet says not to set X-XSS-Protection, or to set it to 0. The old browser filter it controlled could itself introduce issues, and CSP replaces it.