News for hackers. Stuff that matters.

A comment on Cname cloaking, a disguise of third-party trackers. Parent comment

Re:Cname cloaking, a disguise of third-party trackers by mr_toad on Saturday November 23, 2019 @07:12PM (#21617474)
> The only very minor difference between first and third party script inclusion is access to HttpOnly cookies

That’s not a minor difference, http only is used for authentication.

[ Parent | on HN ]
Re:Cname cloaking, a disguise of third-party trackers by jefftk on Saturday November 23, 2019 @07:48PM (#21617617)
Correct. Authentication should always be via cookies with "HttpOnly" set, since (a) the cookie is not needed client side and (b) it somewhat limits the damage XSS can do.
[ Parent | on HN ]