Open fojas opened 8 years ago
The tgt cookie should be httponly to mitigate some common XSS attacks. https://www.owasp.org/index.php/HttpOnly#Mitigating_the_Most_Common_XSS_attack_using_HttpOnly
We currently rely on the cookie being readable by JS to automatically redirect when using multiple browser windows.
The tgt cookie should be httponly to mitigate some common XSS attacks. https://www.owasp.org/index.php/HttpOnly#Mitigating_the_Most_Common_XSS_attack_using_HttpOnly