Re: [WEB SECURITY] Article about HttpOnly

[Kanatoko <anvil@xxxxxxxxxxx>]

Brian Eaton wrote: 
> If somebody knows of CSRF protection techniques that can
> survive an XSS hole in the application, I'd love to hear about them.

How about requireing password (again)?

-- 
Kanatoko<anvil@xxxxxxxxxxx>
Open Source WebAppFirewall
http://guardian.jumperz.net/


----------------------------------------------------------------------------
The Web Security Mailing List: 
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]