3 ms·
If somebody injects JS into your stream, you are most likely screwed, but it doesn't mean your cookies can be stolen. Cookies can be set to HttpOnly (and should
by rorrr 15y ago
If somebody injects JS into your stream, you are most likely screwed, but it doesn't mean your cookies can be stolen. Cookies can be set to HttpOnly (and should be, if you're trying to operate a secure site).
- alecco 15y ago+Secure flag to block sending the cookies over plain HTTP.
- itsnotvalid 15y agoI am guessing that they are able to bypass this restriction.
- alecco 15y agoNo, the attack is against SSL and Man-in-the-Middle. They just make the browser send SSL requests with those cookies, and then guess the cookie (sent inside the SSL session).
- ajross 15y agoYou're in luck! I have a Chrome extension that prevents just that. Let me send you a copy you can install for yourself...