Stealing Http Only cookies with the cookie sandwich technique
Summary: PortSwigger researcher Zak Fedotkin published a technique called the "cookie sandwich" that bypasses the HttpOnly flag on certain servers by placing quotes and legacy cookies like $Version inside cookie values to make the server misparse the Cookie header. The attack was demonstrated against a Flask application and against an application running Apache Tomcat 8.5.x, 9.0.x and 10.0.x, where a reflected XSS flaw and an AWS WAF bypass using an unpatched oncontentvisibilityautostatechange event let him steal an HttpOnly PHPSESSID cookie via a tracking domain that reflected the session parameter in its JSON response.
What you should know: HttpOnly is the control many teams rely on to keep session cookies out of JavaScript's reach, and this technique shows it can be defeated on default Tomcat configurations when an application reflects cookie values or has an XSS flaw. The demonstrated theft of a PHPSESSID through an overlooked tracking domain is the kind of third-party asset that rarely gets the same scrutiny as the main application.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026