http only cookie

Annoyed Antelope answered on June 14, 2021 Popularity 10/10 Helpfulness 3/10

answer http only cookie

http only cookie

Comment

- If the HttpOnly flag (optional) is included in the HTTP response header, 
the cookie cannot be accessed through client side script (again if the 
browser supports this flag). 
- As a result, even if a cross-site scripting (XSS) flaw exists, and a user 
accidentally accesses a link that exploits this flaw, the browser (primarily 
Internet Explorer) will not reveal the cookie to a third party.

- If a browser does not support HttpOnly and a website attempts to set an HttpOnly cookie,
the HttpOnly flag will be ignored by the browser, thus creating a traditional, 
script accessible cookie. 
- As a result, the cookie (typically your session cookie) 
becomes vulnerable to theft of modification by malicious script. "Mitigating".

Popularity 10/10 Helpfulness 3/10 Language go

Source: owasp.org

Tags: go http

Link to this answer
Share Copy Link

Contributed on Jun 14 2021

Annoyed Antelope

0 Answers Avg Quality 2/10

http only cookie

Contents

More Related Answers

http only cookie

Grepper

Documentation

Social

Legal

Contact

Oops, You will need to install Grepper and log-in to perform this action.