3 ms·
Yup, this is something that is frequently not talked about. HttpOnly merely prevents the theft of the cookie via XSS. It doesn't prevent an attacker from perf
by Sohcahtoa82 3y ago
Yup, this is something that is frequently not talked about.
HttpOnly merely prevents the theft of the cookie via XSS. It doesn't prevent an attacker from performing operations on behalf of the user via XSS.
That said, it does make the attack slightly harder. You have to write a bespoke attack script, rather than just a nearly universal one-liner to steal the cookie and then take over from there. In addition, if the victim navigates away from the page, then the attack ends. Of course, most likely, the attack script will only need a few seconds at most to complete the attack script.
- ttfkam 3y agoWhich is why you'd use HttpOnly along with the SameSite=Strict and Secure attributes. This would prevent an attacker from both sniffing and performing operations on behalf of the user via XSS.
- Sohcahtoa82 3y agoSameSite=Strict only prevents CSRF. Secure only means it goes over TLS/SSL only. If the site has XSS, an attacker can still perform operations on behalf of the user even with SameSite and Secure.
- ttfkam 3y agoYou are correct. I was thinking CSRF. XSS is why Content Security Policy exists. script-src 'self' There are no silver bullets, but together, they are greater than the sum of their parts.
- Sohcahtoa82 3y agoIndeed. Defense In Depth is the name of the game.