5 ms·
> HTTPOnly cookies are safe from XSS attacks. Not completely true - the attacker can not exfiltrate the token but they can still make malicious requests right
by madisp 3y ago
> HTTPOnly cookies are safe from XSS attacks.
Not completely true - the attacker can not exfiltrate the token but they can still make malicious requests right there in the victim's browser via XSS.