NYCPHP Meetup

[Chris Shiflett]

inforequest wrote:
> I think Rasmus' example was a cross-site scripting example, not stealing cookies.

I haven't kept up with that thread (nor this one), but the most common 
XSS attacks are those that steal cookies. In fact, this is why there is 
a recommendation for HTTP-only cookies - this would let developers 
essentially hide these cookies from document.cookie.

Maybe that helps clarify something? :-)

Chris

-- 
Chris Shiflett
Brain Bulb, The PHP Consultancy
http://brainbulb.com/