3 ms·
> The only very minor difference between first and third party script inclusion is access to HttpOnly cookies That’s not a minor difference, http only is used
by mr_toad 7y ago
> The only very minor difference between first and third party script inclusion is access to HttpOnly cookies
That’s not a minor difference, http only is used for authentication.
- jefftk 7y agoCorrect. Authentication should always be via cookies with "HttpOnly" set, since (a) the cookie is not needed client side and (b) it somewhat limits the damage XSS can do.