{"comment":{"created_at":"2011-10-13T10:19:08Z","body":"Good idea. I was going to mention this at some point. It's a bit tricky if you want to support it in pre-servlet-3.0 containers though.","updated_at":"2011-10-13T10:19:08Z","url":"https://api.github.com/repos/unfiltered/unfiltered/issues/comments/2393227","id":2393227,"user":{"avatar_url":"https://secure.gravatar.com/avatar/91c15183d9efc15c30ff1e65f084314d?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","url":"https://api.github.com/users/tekul","id":191720,"login":"tekul"}},"action":"created","issue":{"number":83,"created_at":"2011-10-13T01:54:48Z","pull_request":{"diff_url":null,"patch_url":null,"html_url":null},"body":"Cookies by default are subject to xss vulnerabilities without an [HttpOnly](http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly) flag. This should be easy to add with [netty](http://docs.jboss.org/netty/3.1/api/org/jboss/netty/handler/codec/http/Cookie.html#setHttpOnly) and the [servlet sec](http://download.oracle.com/javaee/6/api/javax/servlet/http/Cookie.html#setHttpOnly) support. This will block the ability for in page javascript to steal your a domains cookies","comments":1,"title":"HttpOnly cookie support","updated_at":"2011-10-13T10:19:08Z","url":"https://api.github.com/repos/unfiltered/unfiltered/issues/83","id":1896592,"assignee":null,"milestone":null,"closed_at":null,"user":{"avatar_url":"https://secure.gravatar.com/avatar/355a2b203154bf8a9423fcdecf9e44cc?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","url":"https://api.github.com/users/softprops","id":2242,"login":"softprops"},"html_url":"https://github.com/unfiltered/unfiltered/issues/83","labels":[],"state":"open"},"legacy":{"issue_id":1896592,"comment_id":2393227}}