4 ms·
Great write-up! Why isn’t the PHPSESSID cookie HttpOnly? And why if the XSS was already known had they not fixed it?!
by plugin-baby 3y ago
Great write-up!
Why isn’t the PHPSESSID cookie HttpOnly?
And why if the XSS was already known had they not fixed it?!
- jpc0 3y agoI've had arguments with people storing session tokens in local storage and claiming it is perfectly safe. Not marking the cookie httpOnly ironically doesn't surprise me. TLDR: if you aren't going to look up the very basics of security just use a trusted library
- JakeSkii 3y agoJust to clarify, the PHPSESSID cookie was HttpOnly - I could extract the new value because I had overwritten it. Most of the cookies were set correctly (thankfully) however there was a lot of SPII stored in JS variables which I was able to get.