How can you secure your HTTP cookies against XSS attacks?

Question

Shrikant Mishra · Answer

Cross site scripting (XSS) occurs when the attacker injects executable JavaScript code into the HTML response.

To reduce these attacks, we have to set flags on the set_cookies HTTP header:

HttpOnly - it attribute is used to help prevent attacks such as cross-site scripting since it does not allow the cookie to be accessed via JavaScript.

Secure - it attribute tells the browser to only send the cookie if the request is being sent over HTTPS.

So it would look something like this:

Set-Cookie: sid=<cookie-value>; HttpOnly.

Whether, you are using Express, with express-cookie session, it is working by default.

interview

How can you secure your HTTP cookies against XSS attacks?

Can you answer this question?

1 Answers