2

Is a session cookie set without HttpOnly at first, but added before the client browser finishes rendering, still considered vulnerable? The scanner test I need to satisfy believes so, but is this a false positive?

1 Answer 1

1

This is easy to test. After the browser finishes rendering, open the JavaScript console and try this:

alert(document.cookie)

If you can't access the session id using the terminal, then an attacker cannot access it using XSS.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .