3 ms·
To be clear, they can definitely steal cookies if the HTTPOnly flag isn't enabled. About 60% of the session cookies we see in our scans don't have it enabled. S
by borski 11y ago
To be clear, they can definitely steal cookies if the HTTPOnly flag isn't enabled. About 60% of the session cookies we see in our scans don't have it enabled. Scary.