[27716] in bugtraq
Re: A technique to mitigate cookie-stealing XSS attacks
daemon@ATHENA.MIT.EDU (Florian Weimer)
Tue Nov 5 17:05:50 2002
To: "Michael Howard" <mikehow@microsoft.com>
From: Florian Weimer <Weimer@CERT.Uni-Stuttgart.DE>
Date: Tue, 05 Nov 2002 22:38:32 +0100
In-Reply-To: <4B0F3B603558B44B9F4608630B4F641105356B68@red-msg-06.redmond.corp.microsoft.com> ("Michael
Howard"'s message of "Tue, 5 Nov 2002 10:44:24 -0800")
Message-ID: <87adknlmsn.fsf@Login.CERT.Uni-Stuttgart.DE>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
"Michael Howard" <mikehow@microsoft.com> writes:
> In a nutshell, if Internet Explorer 6.0 SP1 detects a cookie that has a
> trailing HttpOnly (case insensitive) it will return an empty string to
> the browser when accessed from script, such as by using document.cookie.
What about HTTP headers which advise user agents to disable some
features, e.g. read/write access to the document or parts of it via
scripting or other Internet Explorer interfaces?
Is anybody interested in writing an Informational RFC on this topic?
--
Florian Weimer Weimer@CERT.Uni-Stuttgart.DE
University of Stuttgart http://CERT.Uni-Stuttgart.DE/people/fw/
RUS-CERT fax +49-711-685-5898
