RE: A technique to mitigate cookie-stealing XSS attacks

["NESTING, DAVID M (SBCSI)" <dn3723 () sbc com>]

Perhaps JavaScript itself might be a better place to do this?  Create a
simple security API that allows the author to specify their own site's
security policy (under the mask of the user's preferences), so that
JavaScript (or any kind of script, depending on how abstract the browser's
security model is) can only do certain things.  In other words, have some
properties or methods that permanently reduce privileges within the current
document scope (reading cookies, writing cookies, reading document data from
other frames, opening windows, loading url's from off-site, etc.).

This code could then be executed early in the page's life to set up the
security model before anything else can be executed or displayed.  The
permanency would prohibit code executed later from getting those privileges
back.  One could take this a step further and define a security model for an
entire site or URI hierarchy with an external file, a la P3P.  That might be
overkill, though.

HTTP just seems like an inappropriate place to be adding constraints on a
particular scripting language's security model.  

My two cents.

David