3 ms·
+Secure flag to block sending the cookies over plain HTTP.
by alecco 15y ago
+Secure flag to block sending the cookies over plain HTTP.
- itsnotvalid 15y agoI am guessing that they are able to bypass this restriction.
- alecco 15y agoNo, the attack is against SSL and Man-in-the-Middle. They just make the browser send SSL requests with those cookies, and then guess the cookie (sent inside the SSL session).