document.cookie

Help with Snap!
1

How does the XSS protection work? In a request to https://snap.berkeley.edu/snap/snap.html I get a request header

Cookie: snapsession=████████████████████████████████████████████████████████████████████████████████████████████████████████████; persist_session=true

But if I open the console, I get no cookie. I can add other cookies to document.cookie. The x-xss-protection header is not supported by firefox, so it shouldn't do anything.

2

there are a 2 projects made by different people that have blocks that can set cookies, Snap! Build Your Own Blocks and Snap! Build Your Own Blocks

3

I'm asking about how the snap server prevents the snapsession cookie from going in document.cookie, not how to add my own cookies to document.cookie.

4

set-cookie: snapsession=...; httponly;

5

Dan's correct. If you do have that cookie, you can supply it to other requests, but no one should be able to read that cookie via JS.

6

The blocks in the first project is not by me.

7

I know that, it's another project that I found that have cookie blocks