As I was reading the session fixation article on OWASP, I was thinking that the only way for my server to refuse a cookie set by a rogue script would be for my server to know that the browser sent a request without the HTTP-Only flag. Only cookies sent to the server do not include anything more than the cookie name and its value... All the meta data is lost.
What prompted this question are their examples #2 and #3 where they show URLs that look like this:
http://website.kom/<script>document.cookie=”sessionid=abcd”;</script> http://website.kon/<meta http-equiv=Set-Cookie content=”sessionid=abcd”>
Personally, I don't understand how that could even remotely work. Are there any browsers or servers which are that broken? Why would a tag in the URL be accepted by the browser or the server?!
So I think that knowing that the browser had the cookie as HTTP-Only would be useful, but I currently fail to understand how a hacker could set a cookie (which would not be HTTP-Only) assuming that there is no possible breach in my server code.
I would imagine that the only way it could work is if the hacker was to find an XSS in my client or server code. Would that be correct?