The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Clarification on Cookies with XSS

Zhong | Last updated: Oct 04, 2022 01:16AM UTC

I'm working on the lab: Lab: Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped (https://portswigger.net/web-security/cross-site-scripting/contexts/lab-javascript-string-angle-brackets-double-quotes-encoded-single-quotes-escaped). And I'm curious about something; I'm inputting a XSS payload that makes a fetch request to my Burp Collaborator server. However the session cookie (that have http-only flag set), is not being included in the headers in the request. Does the http-only attribute apply to this injected XSS Javascript code that forces the victim app to make a fetch request as well?

Hannah, PortSwigger Agent | Last updated: Oct 05, 2022 01:20PM UTC