Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • 1
    But how does a cookie sent from one domain to the other?? Commented Mar 20, 2016 at 6:55
  • 1
    Now this example, of sending the cookie value to another url, is only going to work if the cookie is not marked as httponly, correct? Commented May 9, 2017 at 20:42
  • @ilans - The content on weak-site.com instructs the client's browser to send the weak-site.com cookie to evil.com in the form of a GET parameter. Commented Jun 9, 2020 at 18:37
  • @IainDuncan - True, the browser will not be able to resolve the value of document.cookie at all if the cookie was marked HttpOnly and the browser supports HttpOnly. Commented Jun 9, 2020 at 18:45