Cookies
HttpOnly cookies: keeping session tokens away from XSS
If an attacker can run script on your page, the first thing they reach for is your session cookie. One cookie flag — HttpOnly — takes that prize off the table.
Tag
If an attacker can run script on your page, the first thing they reach for is your session cookie. One cookie flag — HttpOnly — takes that prize off the table.
CSP is the strongest defense against cross-site scripting — and the most misunderstood header. Here is what it actually does, minus the jargon.