[Vuejs]-How to inject cookies in the Authorization header when they are store in httpOnly

You can’t access HttpOnly tokens from JavaScript, that is the purpose of that attribute.

A better approach is to not handle tokens at all in the browser and instead use the BFF-pattern (Backends for Frontends) as described in this video:

alert‘OAuth 2 0’; // The impact of XSS on OAuth 2 0 in SPAs