I read some articles about XSS and how to mitigate the flaws in a web application. I've seen the HttpOnly on Set-Cookie. Can this flag be bypassed? Or is there another way to access a session cookie?

I read some articles but I think they are too old:

If someone knows a way to bypass it, I would like some explanations.

1 Answer 1


One method is to check if the server supports TRACE method. TRACE method is used for debugging mainly. The response contains the cookies even HttpOnly ones. Then with XSS vulnerability you make a payload with a XHR request with TRACE method and collect the response containing the cookies.

Another technique is a "cookie jar overflow". Chrome has limited space for storing cookies. By creating fake cookies, you can override HttpOnly cookies, but not all web applications are vulnerable. Check if by changing the value of sessionid cookie the account stays logged in


  • +1 for the TRACE method. I've seem a lot of servers that forget to disable it.
    – ThoriumBR
    Sep 5, 2021 at 2:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .