1

Assuming my apache version is higher than 2.2.x (I noticed in previous version the http only cookie can be found anyway) , does http only cookie secures the user session?

Is there any way the user get around the http only cookie in case of XSS to take control of the client information?

  • 1
    This question has been answered here stackoverflow.com/questions/228138/… – iainpb Feb 25 '17 at 12:00
  • 1
    Those are very old answers, the trace method is no longer supported since chrome 25 which released a years ago – TheUnreal Feb 25 '17 at 12:17
  • How should the user take control of the web server using XSS at all? XSS is an attack against the client or to hijack a session but not to take over a server. – Steffen Ullrich Feb 25 '17 at 12:38
  • It more refers to the client, but the client can be the website administrator @SteffenUllrich. I updated the question – TheUnreal Feb 25 '17 at 12:44
1

does http only cookie secures the user session?

Yes, that's the whole idea behind httpOnly.

But as you already mentioned, there may be other vulnerabilities which disclose the cookie. This may happen via vulnerabilities in the server (CVE-2012-0053 which you alluded to), via server misconfiguration (TRACE, although modern browsers do not support it), or via issues in the application itself (the session cookie may be exposed in debug functionality or in the admin backend; an example would be a call to phpinfo in PHP).

It should be noted that httpOnly only mitigates XSS slightly, and that there are various other attack scenarios with XSS that are (almost) as bad as stealing the session (such as CSRF - eg to add new admin users - , phishing, keylogging, reading out secret information, etc).

  • How does CSRF reletaed to XSS? – TheUnreal Feb 25 '17 at 15:23
  • @TheUnreal CSRF protection can be bypassed via XSS (eg by reading out the CSRF token). – tim Feb 25 '17 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.