httpOnly cookies are *prevented* from being accessed by client-side (e.g. in the browser) JavaScript. This attribute, however, has no effect when making a server-side HTTP request.
There are, effectively, a couple of ways to handle this (assuming, of course, you're making an HTTP request using server-side node)...
1. You can grab the cookie from the response headers themselves and return it with your next request, something along the lines of:
var cookie = get(response.headers, "Set-Cookie")
if (cookie) {
cookie = (cookie + "").split(";").shift()
set(opts.headers, "Cookie", cookie)
}
The second approach would be to use Request (
https://github.com/request/request) which essentially does the same thing for cookies as the above code, though more elegantly and supports multiple cookies in the request, plus a lot of other things you can't get out of the box with Node and HTTP requests.
HTH
-- Denny