Gratipay · Report #157563

Cookie:HttpOnly Flag not set

Duplicatestatus

1upvotes

8 Aug 2016disclosed

How it was found

A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. If a malicious script can be run on this application then the cookie will be accessible and can be transmitted to another site.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original