3 ms·

Same goes for session cookies and the 'good thing' about session cookies is that an XSS attack should work anywhere on the domain, rather than just the login pa

Same goes for session cookies and the 'good thing' about session cookies is that an XSS attack should work anywhere on the domain, rather than just the login page (assuming it's not a website with a login form on each page).

homakov 14y ago
michaelmior is completely right. You don't need xss on login page. You can have xss on any page and open an iframe/window with login and then steal via same origin
- kaolinite 14y ago
  Ok, fair point, but even so - it's still not as much of a concern as other XSS and auto-complete vulnerabilities.
  - homakov 14y ago
    XSS is ok. CSRF is ok. Losing my real password is the worst thing to happen
deleted 14y ago
[deleted]