Databases
StackOverflow2013
Postsdbo
POHow do HttpOnly cookies work with AJAX requests?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POHow do HttpOnly cookies work with AJAX requests?
    primarykey
    data
    text
    <p>JavaScript needs access to cookies if AJAX is used on a site with access restrictions based on cookies. Will HttpOnly cookies work on an AJAX site? </p> <p><em>Edit:</em> Microsoft created a way to prevent XSS attacks by disallowing JavaScript access to cookies if HttpOnly is specified. FireFox later adopted this. So my question is: If you are using AJAX on a site, like StackOverflow, are Http-Only cookies an option?</p> <p><em>Edit 2:</em> Question 2. If the purpose of HttpOnly is to prevent JavaScript access to cookies, and you can still retrieve the cookies via JavaScript through the XmlHttpRequest Object, <strong>what is the point of HttpOnly</strong>?</p> <p><em>Edit 3:</em> Here is a quote from Wikipedia:</p> <blockquote> <p>When the browser receives such a cookie, it is supposed to use it as usual in the following HTTP exchanges, but not to make it visible to client-side scripts.[32] The <code>HttpOnly</code> flag is not part of any standard, and is not implemented in all browsers. Note that there is currently no prevention of reading or writing the session cookie via a XMLHTTPRequest. [33].</p> </blockquote> <p>I understand that <code>document.cookie</code> is blocked when you use HttpOnly. But it seems that you can still read cookie values in the XMLHttpRequest object, allowing for XSS. How does HttpOnly make you any safer than? By making cookies essentially read only? </p> <p>In your example, I cannot write to your <code>document.cookie</code>, but I can still steal your cookie and post it to my domain using the XMLHttpRequest object.</p> <pre><code>&lt;script type="text/javascript"&gt; var req = null; try { req = new XMLHttpRequest(); } catch(e) {} if (!req) try { req = new ActiveXObject("Msxml2.XMLHTTP"); } catch(e) {} if (!req) try { req = new ActiveXObject("Microsoft.XMLHTTP"); } catch(e) {} req.open('GET', 'http://stackoverflow.com/', false); req.send(null); alert(req.getAllResponseHeaders()); &lt;/script&gt; </code></pre> <p><em>Edit 4:</em> Sorry, I meant that you could send the XMLHttpRequest to the StackOverflow domain, and then save the result of getAllResponseHeaders() to a string, regex out the cookie, and then post that to an external domain. It appears that Wikipedia and ha.ckers concur with me on this one, but I would love be re-educated...</p> <p><em>Final Edit:</em> Ahh, apparently both sites are wrong, this is actually a <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=380418" rel="noreferrer">bug in FireFox</a>. IE6 &amp; 7 are actually the only browsers that currently fully support HttpOnly.</p> <p>To reiterate everything I've learned:</p> <ul> <li>HttpOnly restricts all access to document.cookie in IE7 &amp; and FireFox (not sure about other browsers)</li> <li>HttpOnly removes cookie information from the response headers in XMLHttpObject.getAllResponseHeaders() in IE7.</li> <li>XMLHttpObjects may only be submitted to the domain they originated from, so there is no cross-domain posting of the cookies.</li> </ul> <p><em>edit: This information is likely no longer up to date.</em></p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. USShawn
    1. USShawn
    plurals
    1. This table or related slice is empty.
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    3. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POHow do HttpOnly cookies work with AJAX requests?
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POHow do HttpOnly cookies work with AJAX requests?
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POHow do HttpOnly cookies work with AJAX requests?
      1. This table or related slice is empty.
      1. VTUpMod
    1. COI threw your example in a greasemonkey script and it looks like FF no longer displays cookies. Excellent research and example.
      singulars
      1. POHow do HttpOnly cookies work with AJAX requests?
      1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload