Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a session token that's stored in a browser cookie client side. The cookie is already available for scripting and it's used to validate XHR through Javascript. For a particular page I'm using an iFrame to upload data to the server. Would there be any issues, beyond what I'm already exposed to, by including the session token as a hidden field in my iFrame?

share|improve this question
up vote 3 down vote accepted

This is a bad design. You should be setting the HTTPOnly flag on your cookies because it makes xss more difficult to exploit (but not impossible). If you write the cookie value to the page, then it undermines the protection provided by this flag.

Why are you including the cookie value in a variable with each request? The point of a cookie is that it occupies the Cookie: http header element of every request... which is redundant. It doesn't matter where the request originates from, the browser keeps track of the cookie. This is one of the reasons why CSRF is a problem.

Read the CSRF prevention cheat sheet and use one of these methods to protect your requests.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.