Is it possible for a XSS attack to obtain HttpOnly cookies?
- by Dan Herbert
Reading this blog post about HttpOnly cookies made me start thinking, is it possible for an HttpOnly cookie to be obtained through any form of XSS? Jeff mentions that it "raises the bar considerably" but makes it sound like it doesn't completely protect against XSS.
Aside from the fact that not all browser support this feature properly, how could…