4 ms·
It's not the same, an XSS is not comparable to a shell for the exact reason I outlined above. And a session is not a password. I'm probably coming over as too
by SCHiM 10y ago
It's not the same, an XSS is not comparable to a shell for the exact reason I outlined above. And a session is not a password.
I'm probably coming over as too offensive, but you really really don't seem to know what you are even talking about. You are wrong wrong wrong.
- tptacek 10y agoI'm pretty sure? I do know what I'm talking about here. Sorry. HttpOnly is a joke.
- kkl 10y agoIf you don't believe `tptacek maybe you will believe James Kettle: http://blog.portswigger.net/2016/05/web-storage-lesser-evil-for-session.html http://blog.portswigger.net/2016/05/web-storage-lesser-evil-...