search

w3c / network-error-logging

Network Error Logging
https://w3c.github.io/network-error-logging/
Other
80 stars 18 forks source link

NEL header injection attack allows stealing HttpOnly cookies #112

Open chlily1 opened 5 years ago

chlily1 commented 5 years ago

If an attacker is able to inject a NEL header that requests that Cookie headers be sent in the request_headers report field, then any HttpOnly cookies could also be stolen, which would not be possible with a regular header injection attack.

clelland commented 1 year ago

Discussed at TPAC, and the sentiment in the room was that we perhaps should simply not send cookies in reports.