Comment on Cookie Bomb or Let's Break the InternetparentComments−nly12yThat page, and the linked browsersec pages on Google Code, are terrifying. Time to burn it all down and start from scratch.I was particularly stunned to learn HTTP Cookie headers can clobber 'secure' cookies set over HTTPS. Eye-popping.−wglb12yAnd to increase your terror, check out http://lcamtuf.coredump.cx/postxss/
Comments
That page, and the linked browsersec pages on Google Code, are terrifying. Time to burn it all down and start from scratch.
I was particularly stunned to learn HTTP Cookie headers can clobber 'secure' cookies set over HTTPS. Eye-popping.
And to increase your terror, check out http://lcamtuf.coredump.cx/postxss/