Question

I’m creating a static site generator with a dynamic admin backend for one user. The site accepts no user input. Does this mean that I am safe from attackers who are trying to steal my admin cookie?

(there is no user input, so XSS and other methods don’t work, right?)

Answer 1

If there’s no user input (no links to click that have any effects, etc.), how does the admin backend qualify as “dynamic”?

But basically: No, not unless you’re using HTTPS. Even if you’re not accepting input, the cookie is transmitted in plaintext and so can be captured (by a man-in-the-middle attack, etc.) and used. (I assume you don’t want other people using the cookie to see the admin stuff.)

Or did I completely misunderstand the question? 😉