⬇ Download holy card: ·
Blessed Cookie Sandwich, Filled With Secrets
Patron of HttpOnly cookies, parsers that still remember the 1997 rules, and anyone reflecting cookies back in responses.
Life
Presented by PortSwigger in January 2025, it exploits the way some servers still interpret the old cookie rules. A cookie with an opening quote before, one with the closing quote after, and the server merges everything into a single value, including the HttpOnly cookie in the middle; if it then reflects it in the page, it hands it to JavaScript. No CVE: it is a technique, not a single bug.
Prayer
O Blessed Cookie Sandwich, who fills between two slices what should have stayed hidden, let our servers stop speaking the language of 1997. Amen.
How to celebrate
Celebrated with a cookie sandwich, checking that no page reflects the cookies it receives.
There's more room between two quotes than you think.