> This means that the malicious script can read the user's cookies, session tokens, stored usernames and passwords, or files on a local hard drive. I've seen t

> This means that the malicious script can read the user's cookies, session tokens, stored usernames and passwords, or files on a local hard drive. I've seen those. On a website for a company who hired me for building their server infrastructure. The password was in clear text in the main cookie. I signaled it and the dev team corrected it. It was only 3 years ago...