3 ms·
HttpOnly, and, as far as I know, HTTP-only cookies can't be injected if you use HTTPS. * HttpOnly restricts all access to document.cookie in IE7, Firefox 3, an
by imaginenore 12y ago
HttpOnly, and, as far as I know, HTTP-only cookies can't be injected if you use HTTPS.
* HttpOnly restricts all access to document.cookie in IE7, Firefox 3, and Opera 9.5 (unsure about Safari)
* HttpOnly removes cookie information from the response headers in XMLHttpObject.getAllResponseHeaders() in IE7. It should do the same thing in Firefox, but it doesn't, because there's a bug.
* XMLHttpObjects may only be submitted to the domain they originated from, so there is no cross-domain posting of the cookies.