Re: [WEB SECURITY] Article about HttpOnly

["Amit Klein (AKsecurity)" <aksecurity@xxxxxxxxxx>]

On 11 Aug 2006 at 18:45, Brian Eaton wrote:

> Yeah, that's a good point Chris.  You need to have a CSRF
> vulnerability to bootstrap into an exploit for the (reflected) XSS
> vulnerability.
> 

Well, just keep in mind that there are server-specific XSS vulnerabilities (e.g. Apache's 
Expect header XSS), 3rd party/sample code XSS, etc. - so XSS may exist outside your 
application, yet have effect on your anti-CSRF measures.

-Amit


----------------------------------------------------------------------------
The Web Security Mailing List: 
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]