5 ms·
Chrome extensions can also inject code via a content script and gather local storage data. You can't control what extensions people are running.
by tmpz22 6y ago
Chrome extensions can also inject code via a content script and gather local storage data. You can't control what extensions people are running.
- minhazm 6y agoThat also applies to cookies. Users can run any browser or script to access your site and do whatever they want with the cookies.
- gigaftp 6y agoIn the context of a compliant web browser you can set a cookie as http only as to disallow access it via Js.
- Jenk 6y agoNot for http-only cookies it doesn't.
- fractionalhare 6y agoNo they can’t, refer to the documentation on cookie flags and attributes like httpOnly: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies