HTTP cookie: Difference between revisions

Revision as of 20:51, 29 January 2011

Revision as of 00:16, 31 January 2011

Line 33:

=== HttpOnly Cookie ===

HttpOnly cookie is still in IETF draft<ref name="httponlyrfc">IETF [http://tools.ietf.org/html/draft-ietf-httpstate-cookie-20 Internet Draft: HTTP State Management Mechanism - Dec 19, 2010] Obsoletes RFC 2965 (if approved). </ref>, though most of the modern browsers support it. On a supported browser, a HttpOnly cookie will only be used when transmitting HTTP (or HTTPS) requests, but the cookie valuevalues isare unavailable to JavaScript.client Thisside willscript, effectivelyhence thwartmitigate the threat of cookie theft via [[Cross-site scripting]] if the cookies required to perform critical actions are all HttpOnly.

=== Third-party cookie ===