Security issues caused by HttpOnly flag setting in the browser

Security issues caused by HttpOnly flag setting in the browser

1. Introduction

If the HttpOnly flag is set for the cookie, you can avoid JavaScript reading the cookie when XSS occurs. This is also the reason why HttpOnly is introduced. But can this method defend against attackers? The HttpOnly flag prevents the cookie from being "read". Can it prevent the cookie from being "written? The answer is no, so there is an article here, because it has been proved that the HttpOnly mark of Some browsers can be overwritten by JavaScript writing, which may be exploited by attackers to launch session fixation attacks. The topic of this article is to discuss this technology.

2. Use JavaScript to overwrite the HttpOnly flag in the cookie

When JavaScript can overwrite the HttpOnly flag in the cookie, attackers can use the HttpOnly cookie to launch the session fixation attack (