Skip to main content
2 votes

What is the next layers of defence against cookie stealing if GET parameter is vulnerable to XSS and there is no HttpOnly flag in a website?

Presented in order from "normal" to "insane, never attempt this": There might be mitigations against XSS, such as Content Security Policy (CSP). However, if you can execute an XSS ...
CBHacking's user avatar
  • 49.5k
1 vote

What is the next layers of defence against cookie stealing if GET parameter is vulnerable to XSS and there is no HttpOnly flag in a website?

Since other answers have focused briefly on the different techniques to mitigate or control XSS, but I want to just focus on CSP in this regard, because I’d say CSP is the most common tactic to battle ...
security_paranoid's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible