News for hackers. Stuff that matters.
Re:Hackers Think Cookies Are Tasty, Too by Oduig on Tuesday April 02, 2013 @04:13PM (#5481806)
Isn't XSS only a client side danger? For URLs, this is relevant since you can post a malicious link and people can click on it. It's much harder to get someone else's browser to accept a cookie you made for a specific website.

Of course, cookies are still client-side data and should not be trusted. But XSS is not a problem here. Correct me if I'm wrong.

Re:Hackers Think Cookies Are Tasty, Too by trebor on Tuesday April 02, 2013 @04:17PM (#5481829)
Not if your server environment is running Node.js! If you start reading cookies and potentially evaluating their content, this could have a major impact on a Node process. That said, I doubt that you could hack a running Node process with this without the system using eval() on the cookie contents. I've been wrong before....