← All practicals

Steal a cookie — then watch the theft get caught

Prove HttpOnly hides the real cookie from JavaScript, then replay a sandbox token from an "attacker" browser and watch it get flagged.

1. 1

   Read your own document.cookie on this page and compare it to the reported cookie policy.

   The real session cookie is simply ABSENT from document.cookie — HttpOnly means page JavaScript (or an XSS payload) can never read it. This is the theft-defense proven live, not asserted.

2. 2

   Mint a sandbox token, then replay it picking "same browser".

   A same-fingerprint replay is ordinary reuse — the coarse UA-family binding matches, so nothing is flagged.

3. 3

   Mint another sandbox token, then replay it picking "attacker's Linux curl".

   The presented fingerprint no longer matches the one the token was bound to at mint time — that mismatch IS the detection. A real session_hijack alert is raised, live — read it on your own X-ray under 'Security alerts your activity raised'.

4. 4

   Revoke the flagged sandbox session.

   Revoke is the response to a detected hijack: kill the session outright rather than hope the thief stops using it.