2 added 94 characters in body
source | link

As the commentators suggested you correctly, you will need to use the HttpOnly fla as a solution. But I just want to add a note regarding the right comments you received about HttpOnly flag.

In fact, if a client of your website uses a Mozilla Firefox browser of version before 3.0.6 (Bug 380418: XMLHttpRequest allows reading HTTPOnly cookies) and/or SeaMonkey browser of version before 1.1.15 (Rough Changelog for SeaMonkey 1.1.4) the HttpOnly won't be helpful because this flag won't be able to remove cookie information from the response headers in MLHttpObject.getAllResponseHeaders().

Further reading.

As the commentators suggested you correctly, you will need to use the HttpOnly fla as a solution. But I just want to add a note regarding the right comments you received about HttpOnly flag.

In fact, if a client of your website uses a Mozilla Firefox browser of version before 3.0.6 (Bug 380418: XMLHttpRequest allows reading HTTPOnly cookies) and/or SeaMonkey browser of version before 1.1.15 (Rough Changelog for SeaMonkey 1.1.4) the HttpOnly won't be helpful because this flag won't be able to remove cookie information from the response headers in MLHttpObject.getAllResponseHeaders().

As the commentators suggested you correctly, you will need to use the HttpOnly fla as a solution. But I just want to add a note regarding the right comments you received about HttpOnly flag.

In fact, if a client of your website uses a Mozilla Firefox browser of version before 3.0.6 (Bug 380418: XMLHttpRequest allows reading HTTPOnly cookies) and/or SeaMonkey browser of version before 1.1.15 (Rough Changelog for SeaMonkey 1.1.4) the HttpOnly won't be helpful because this flag won't be able to remove cookie information from the response headers in MLHttpObject.getAllResponseHeaders().

Further reading.

1
source | link

As the commentators suggested you correctly, you will need to use the HttpOnly fla as a solution. But I just want to add a note regarding the right comments you received about HttpOnly flag.

In fact, if a client of your website uses a Mozilla Firefox browser of version before 3.0.6 (Bug 380418: XMLHttpRequest allows reading HTTPOnly cookies) and/or SeaMonkey browser of version before 1.1.15 (Rough Changelog for SeaMonkey 1.1.4) the HttpOnly won't be helpful because this flag won't be able to remove cookie information from the response headers in MLHttpObject.getAllResponseHeaders().