Home/ Questions/Q 961123
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-16T01:17:31+00:00

Say there is a site foo.com which loads JavaScript from site bar.com . Now,

  • 0

Say there is a site foo.com which loads JavaScript from site bar.com. Now, say the JavaScript from site bar.com tries to read cookies using document.cookies. I was under the impression that using JavaScript, you can read all the cookies set in the browser irrespective of their source. But it turns out that the JavaScript from the site bar.com can only access cookies set by bar.com and not any other. If this is the case, how are script injection attacks which steal cookies carried out?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    But it turns out that the JavaScript from the site bar.com can only access cookies set by bar.com and not any other.

    That isn’t true. What matters is where the HTML document containing the <script> element is, not the URL of the JS file that said <script> mentions in the src attribute.

    I suspect your problem is that you are accessing document.cookies when the property is called document.cookie (Singular!)

    • 0