4 ms·
You are wrong. It does. It keeps your user's session from being trivially stolen. In practise this makes successfully executing attacks harder. It's not a _nice
by SCHiM 10y ago
You are wrong. It does. It keeps your user's session from being trivially stolen. In practise this makes successfully executing attacks harder. It's not a _nice_ thing to have, it's essential.
An example of this is an application that asks you to confirm <action> after a POST or w/e. If your XSS vector is not in the new page, then you can't execute <action> as an attacker automatically.
Many, many, applications (not only on the web) implement such a scheme.
A stolen session is MUCH more valuable to an attacker than only a raw XSS.
- tptacek 10y agoIt does not. It is the difference between an exploit that yields a root password and one that yields a shell at uid=0. HttpOnly is almost totally cosmetic.
- SCHiM 10y agoIt's not the same, an XSS is not comparable to a shell for the exact reason I outlined above. And a session is not a password. I'm probably coming over as too offensive, but you really really don't seem to know what you are even talking about. You are wrong wrong wrong.
- tptacek 10y agoI'm pretty sure? I do know what I'm talking about here. Sorry. HttpOnly is a joke.
- kkl 10y agoIf you don't believe `tptacek maybe you will believe James Kettle: http://blog.portswigger.net/2016/05/web-storage-lesser-evil-for-session.html http://blog.portswigger.net/2016/05/web-storage-lesser-evil-...