unfiltered/unfiltered — Issue #83: HttpOnly cookie support
Author: softprops
Created: 2011-10-13 01:54:48+00:00
State: open

Cookies by default are subject to xss vulnerabilityes without an [HttpOnly](http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly) flag. This should be easy to add with [netty](http://docs.jboss.org/netty/3.1/api/org/jboss/netty/handler/codec/http/Cookie.html#setHttpOnly) and the [servlet sec](http://download.oracle.com/javaee/6/api/javax/servlet/http/Cookie.html#setHttpOnly) support. This will block the ability for in page javascript to steal your a domains cookies