Use HttpOnly Session Cookies for Improved Storefront Security

When you enable HttpOnly session cookies, the storefront stores Shopper Login and API Access Service (SLAS) access and refresh tokens as HttpOnly cookies instead of local storage. The server-side SLAS proxy layer handles token injection transparently. Only browsers can read and send HttpOnly cookies. JavaScript code that runs on the page can’t access them. Using HttpOnly cookies prevents client-side scripts from exploiting the storefront and makes the storefront more secure.

Prerequisite 

PWA Kit version 3.19 or later. See the pwa-kit GitHub repository.

For more information about HttpOnly cookies and how to configure them in composable storefronts, see pwa-kit GitHub: HttpOnly Session Cookies — Architecture. For more information about HttpOnly cookie storage, see pwa-kit GitHub: HttpOnly Mode: SLAS Property Storage Mapping.

Node 20 Deprecation

Node 20 has an end-of-life date of April 30, 2026. We strongly recommend that you update your production projects to Node 22 or Node 24 by upgrading to the latest minor version of PWA Kit 3.x. See full details on Node support dates and upgrade steps in Upgrade Node Version.

Announcements
Choose Your B2C Commerce Storefront Type
B2C Commerce
SCAPI
Storefront Next
Composable Storefront
Composable Storefront Overview
Quick Start
Deploy Your Code
Skills for Success
Introduction to Composable Storefront
Use Composable Storefront in a Hybrid Implementation
PWA Kit Framework
Performance Guide for Composable Storefronts
Get Set Up
Build Your Site
Build B2C Storefronts Faster with the B2C DX MCP Server
Accelerate PWA Kit Development with the PWA Kit MCP Server (Developer Preview)
Integrate Page Designer with PWA Kit
Environment Variables
Template Extensibility
Provide Orders from Salesforce Order Management
Implement Password Reset
Implement Passwordless Login
Implement Social Login
Personalize with Cookies
Use HttpOnly Session Cookies for Improved Storefront Security
Maintain Shopper Sessions Across Subdomains in Your Composable Storefront
Personalize with Shopper Context
Boost In-Store Sales with Store Locator
Expand Shopping Options with In-Store Pickup
Ship Products to Multiple Addresses and Stores in a Single Order
Configure Address Autocomplete for Your B2C Commerce PWA Kit Storefronts
Configure One-Click Checkout for Your B2C Commerce Composable Storefronts
Protect Privacy with a Tracking Consent Banner
Limit Access to a Storefront Under Development
Maximize Your Cache Hit Ratio
Improve SEO with a Sitemap
Enable Your Merchant Team
Test, Launch, and Monitor
Maintain
Composable Storefront Specifications
Storefront Reference Architecture (SFRA)
Commerce Apps ISV Developer Guide
B2C Commerce Solutions
B2C Commerce Release Notes
B2C Commerce Reference Information
Ask the Community