The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

path — 

Used to specify the URL path for which the cookie is valid.

■■

secure

– If this attribute is set, then the cookie will only ever be submit-

ted in HTTPS requests.

■■

HttpOnly — 

If this attribute is set, then the cookie cannot be directly

accessed via client-side JavaScript, although not all browsers support

this restriction.

Chapter 3 

■

Web Application Technologies

43

70779c03.qxd:WileyRed  9/14/07  3:12 PM  Page 43

---

Each of these cookie attributes can impact the security of the application,

and the primary impact is on the ability of an attacker to directly target other

users of the application. See Chapter 12 for further details.

Status Codes

Each HTTP response message must contain a status code in its first line, indi-

cating the result of the request. The status codes fall into five groups, accord-

ing to the first digit of the code:

■■