开发者

JS |Xss defence question

开发者 https://www.devze.com 2023-04-06 17:30 出处：网络
I have a website where users can post comments. I want to know that if they find an xss hole, if they can still get the cookie data although it\'s httpOnly with some kind of XHTTPrequest, Ajax 开发者_
相关专题：cookiesjavascriptxss

I have a website where users can post comments. I want to know that if they find an xss hole, if they can still get the cookie data although it's httpOnly with some kind of XHTTPrequest, Ajax 开发者_Go百科call or something. Is it possible?

HTTP-only cookies cannot be retrieved by JavaScript. Hence "HTTP-only".

0

上一篇:

:下一篇

更多 问答 相关资讯：

精彩评论

暂无评论...
登录 注册
Qedev.com
验证码 换一张
取 消

    关注公众号

    热门标签

    图文推荐

    Delphi - Custom drawing a message list

    Delphi - Custom drawing a message list
    C++ header-only include pattern

    C++ header-only include pattern
    IE7 Margin Collapses Into Padding

    IE7 Margin Collapses Into Padding
    in CoffeeScript, how can I use a variable as a key in a hash?

    in CoffeeScript, how can I use a variable as a key in a hash?
    Interactive visualization of a graph in python [closed]

    Interactive visualization of a graph in python [closed]
    How to customise PHP MYSQL tables?

    How to customise PHP MYSQL tables?
    High quality, simple random password generator

    High quality, simple random password generator
    Image Recognition ApI in android

    Image Recognition ApI in android

    开发者开发者网给大家分享系统运维,大数据运维,云计算,编程开发技巧,路由交换,运维和开发相关的资讯及技术文章，同时StackOverflow中文社区，知识经验交流分享。

    法律声明：本站内容均为网友上传，网站举办方负责审核和监督，如存在版权或非法内容，欢迎举报，我们将尽快予以删除。邮箱：devze@qq.com

    Copyright © 2018-2020 开发者. All rights reserved. Powered by 开发者ICP备案号: 京ICP备10032868号-9