demo · v140

Attack Walkthrough

An XSS injection tries to overwrite a session cookie with one the attacker controls. Toggle the cookie's name between session, __Secure-session, and __Http-session and watch which step finally stops the attack.

cookie name: session __Secure-session __Http-session 
// Attacker injects this via stored XSS:
document.cookie = `${NAME}=attacker-controlled; path=/; Secure`;
// then forces a navigation that the server logs in to.

the core invariant

An XSS attacker has full control of document.cookie. __Secure- blocks them from setting one over HTTP, but it does not block them from overwriting a same-named secure cookie. __Host- binds the cookie to a Path of / with no Domain attribute, useful but not a control. __Http- is the missing piece: it explicitly forbids document.cookie from setting a cookie of that name at all. The server holds the only pen.

see also