开发者

JS |Xss defence question

I have a website where users can post comments. I want to know that if they find an xss hole, if they can still get the cookie data although it's httpOnly with some kind of XHTTPrequest, Ajax 开发者_Go百科call or something. Is it possible?


HTTP-only cookies cannot be retrieved by JavaScript. Hence "HTTP-only".

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜