The cookie specifications constrain cookies to be sent back only to the servers in the same domain as the server from which they originate. However, the value of cookies can be sent to other servers using means different from the codice_25 header.

In particular, scripting languages such as JavaScript and JScript are usually allowed access to cookie values and have some means to send arbitrary values to arbitrary servers on the Internet. These facts are used in combination with sites allowing users to post HTML content that other users can see.

As an example, an attacker running the domain codice_26 may post a comment containing the following link to a popular blog they do not otherwise control:

When another user clicks on this link, the browser executes the piece of code within the codice_28 attribute, thus replacing the string codice_11 with the list of cookies of the user that are active for the page. As a result, this list of cookies is sent to the codice_26 server, and the attacker is then able to collect the cookies of other users.

This type of attack is difficult to detect on the user side because the script is coming from the same domain that has set the cookie, and the operation of sending the value appears to be authorised by this domain. It is usually considered the responsibility of the administrators running sites where users can post to disallow the posting of such malicious code.

Cookies are not directly visible to client-side programs such as JavaScript if they have been sent with the HttpOnly flag. From the point of view of the server, the only difference with respect of the normal case is that the set-cookie header line is added a new field containing the string `HttpOnly':

When the browser receives such a cookie, it is supposed to use it as usual in the following HTTP exchanges, but not to make it visible to client-side scripts. The `HttpOnly` flag is not part of any standard, and is not implemented in all browsers. Note that there is currently no prevention of reading or writing the session cookie via an XMLHTTPRequest.

Cookie poisoning
Browser settings
Cookie attributes
Cookie theft