Re: Re: Question regarding CVE applicability of missing HttpOnly flag

[Henri Salo <henri () nerv fi>]

On Thu, Jun 26, 2014 at 05:30:46PM +1000, Murray McAllister wrote:
> But websites set lots of cookies, which if stolen, have no relevance
> to being able to access the user's session, or do much of anything
> useful with anyway. I believe a lot of the "this cookie does not
> have HTTPOnly" issues are non-issues.

Those CVEs should be REJECTED. Can you provide list of non-issues with CVE?

---
Henri Salo

Attachment: signature.asc
Description: Digital signature