Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

NEL header injection attack allows stealing HttpOnly cookies #112

Open
chlily1 opened this issue Apr 9, 2019 · 1 comment
Open

NEL header injection attack allows stealing HttpOnly cookies #112

chlily1 opened this issue Apr 9, 2019 · 1 comment

Comments

@chlily1
Copy link

chlily1 commented Apr 9, 2019

If an attacker is able to inject a NEL header that requests that Cookie headers be sent in the request_headers report field, then any HttpOnly cookies could also be stolen, which would not be possible with a regular header injection attack.
@martinthomson martinthomson mentioned this issue Sep 14, 2023
Closed
@clelland clelland mentioned this issue Sep 14, 2023
Open
@clelland
Copy link
Contributor

Discussed at TPAC, and the sentiment in the room was that we perhaps should simply not send cookies in reports.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@clelland @chlily1