comment on

As of just now, I've switched the cookies that the Perlmonks domains set to have the HTTPOnly attribute. This means that the most trivial XSS attack won't be able to steal cookies from here, as the browser will not make the cookie available to Javascript code.

This should be testable locally by pasting the following text into your browser Javascript console while on a Perlmonks domain:

    javascript:alert(document.cookies);
[download]

If the userpass cookie still shows up there, you might need to log out and log in again.

I believe this will have no ill side-effects.

If you have a genuine use-case for giving Javascript access to the site cookie, please speak up so we can discuss a work-around.

In reply to Cookies switched to HTTPOnly Cookies by Co-Rion

Are you posting in the right place? Check out Where do I post X? to know for sure.
Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
<code> <a> <b> <big> <blockquote> <br /> <dd> <dl> <dt> <em> <font> <h1> <h2> <h3> <h4> <h5> <h6> <hr /> <i> <li> <nbsp> <ol> <p> <small> <strike> <strong> <sub> <sup> <table> <td> <th> <tr> <tt> <u> <ul>
Snippets of code should be wrapped in <code> tags not <pre> tags. In fact, <pre> tags should generally be avoided. If they must be used, extreme care should be taken to ensure that their contents do not have long lines (<70 chars), in order to prevent horizontal scrolling (and possible janitor intervention).
Want more info? How to link or How to display code and escape characters are good places to start.


laziness, impatience, and hubris
	PerlMonks