Cookies
HttpOnly cookies: keeping session tokens away from XSS
If an attacker can run script on your page, the first thing they reach for is your session cookie. One cookie flag — HttpOnly — takes that prize off the table.
Tag
If an attacker can run script on your page, the first thing they reach for is your session cookie. One cookie flag — HttpOnly — takes that prize off the table.
A session cookie is the key to a logged-in account. Three small flags decide whether that key is protected or up for grabs. Here is the five-minute version.