# Stealing HttpOnly cookies with the cookie sandwich technique

DevFeed: [Stealing HttpOnly cookies with the cookie sandwich technique](<https://devfeed.tech/articles/stealing-httponly-cookies-with-the-cookie-sandwich-technique-7701.md>)

Original publisher: [Read original article](<https://portswigger.net/research/stealing-httponly-cookies-with-the-cookie-sandwich-technique>)

Author: Zakhar Fedotkin

Published: 2025-01-22T14:45:11Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [Chrome](<https://devfeed.tech/topics/chrome.md>), [Cross-origin resource sharing (CORS)](<https://devfeed.tech/topics/cors.md>), [browser](<https://devfeed.tech/topics/browser.md>), [Web](<https://devfeed.tech/topics/web.md>)

Tags: [browser](<https://devfeed.tech/tags/browser.md>), [chrome](<https://devfeed.tech/tags/chrome.md>), [cors](<https://devfeed.tech/tags/cors.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [web](<https://devfeed.tech/tags/web.md>), [xss](<https://devfeed.tech/tags/xss.md>)

## AI overview

This security research describes the "cookie sandwich" technique, which abuses legacy cookie parsing, quoted values, and browser behavior to bypass the HttpOnly flag on certain servers. By manipulating cookie structure, reflected parameters, analytics identifiers, CORS requests with credentials, or same-origin XSS, an attacker may expose sensitive HttpOnly cookie values to client-side scripts.

## Source excerpt

In this post, I will introduce the "cookie sandwich" technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version cookie