pencil
commented
8 years ago We currently rely on the cookie being readable by JS to automatically redirect when using multiple browser windows.
Open fojas opened 8 years ago
pencil
commented
8 years ago We currently rely on the cookie being readable by JS to automatically redirect when using multiple browser windows.
The tgt cookie should be httponly to mitigate some common XSS attacks. https://www.owasp.org/index.php/HttpOnly#Mitigating_the_Most_Common_XSS_attack_using_HttpOnly