Hacker News Reader

Comment by SCHiM | Hacker News Reader

I've tested many web applications, and around 80% of all applications I've tested contained an XSS of some sort or another, that number drops to around 40% if you only look at stored XSS & XSS in a get request. And to less than 10% when only looking at stored XSS.

Unless you've used cookies with the HttpOnly flag XSS trivially escalates to session stealing. Do NOT store sessions in anything other than cookies with the HttpOnly (and really, SecureFlag) flag set.

Using javascript to manage your sessions only the client side in any way is NOT secure.

View on HN

> Unless you've used cookies with the HttpOnly flag XSS trivially escalates to session stealing

Then again you could just use CSP and mitigate almost 100% of those XSS cases. Yes, even most of the stored ones. And with JWT + JavaScript you don't have to worry about all the oddities in the way cookies work, which is a huge plus.

CSP isn't a silver bullet.

Nor is HttpOnly, really.

I never said it was.

if you are vulnerable to XSS your HttpOnly cookie won't help you.

You are wrong. It does. It keeps your user's session from being trivially stolen. In practise this makes successfully executing attacks harder. It's not a _nice_ thing to have, it's essential.

An example of this is an application that asks you to confirm <action> after a POST or w/e. If your XSS vector is not in the new page, then you can't execute <action> as an attacker automatically.

Many, many, applications (not only on the web) implement such a scheme.

A stolen session is MUCH more valuable to an attacker than only a raw XSS.

It does not. It is the difference between an exploit that yields a root password and one that yields a shell at uid=0.

HttpOnly is almost totally cosmetic.

It's not the same, an XSS is not comparable to a shell for the exact reason I outlined above. And a session is not a password.

I'm probably coming over as too offensive, but you really really don't seem to know what you are even talking about. You are wrong wrong wrong.

If you don't believe `tptacek maybe you will believe James Kettle:

http://blog.portswigger.net/2016/05/web-storage-lesser-evil-...

I'm pretty sure? I do know what I'm talking about here. Sorry. HttpOnly is a joke.

> Using javascript to manage your sessions only the client side in any way is NOT secure.

And yet it's common practice, at least in the SPA communities with which I engage on a regular basis.

Reply on news.ycombinator.com