3 ms·

You can steal cookies with XSS?

• gizmo 18y ago
  In some situations. See: http://jehiah.cz/archive/xss-stealing-cookies-101 http://jehiah.cz/archive/xss-stealing-cookies-101
  • andreyf 18y ago
    document.cookie, wow... Guess you learn something new every day. For those interested, this has a good explanation: http://www.quirksmode.org/js/cookies.html http://www.quirksmode.org/js/cookies.html
• simonw 18y ago
  Yes. That's why XSS is such a serious security problem. And even if you can't steal cookies, you can still do nasty things like re-target the login form's action to point at your own server and hence steal people's passwords.