Smart Cookies: The Restricted Access Cookie

The cross-site scripting attack is widely prevalent and a number of real world attacks have been re-ported. One way to curb scripting attack would be to require interactive websites to carefully escape all user-provided content so that client browsers do not execute untrusted scripts. However, even though many popular web programming environments pro-vide the necessary functions to escape scripts, there have been a number of high-profile cases of cookie theft [1, 3]. Another approach explores the effect that each cookie has on the rendering of the page, and concludes that if there are no effects, the cookie is unnecessary [2]. While the authors don’t describe their solution as a method of preventing cookie theft, it is possible that some of their techniques could b