3 ms·

I believe that it's not an HTTPOnly Cookie (which is a problem because of XSS), and that it gets set in JS just before the request. The idea is that due to the

I believe that it's not an HTTPOnly Cookie (which is a problem because of XSS), and that it gets set in JS just before the request. The idea is that due to the Same Origin Policy, other sites will not be able to set the Cookie for your domain.

preinheimer 13y ago
But I can throw in an iframe or something to get your browser to make a request against that domain (and get a cookie)
- nbpoole 13y ago
  You can't just read cookies for arbitrary domains in an iframe.