---
id: 5048
title: "Stealing HttpOnly cookies with the cookie sandwich technique"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/stealing-httponly-cookies-with-the-cookie-sandwich-technique"
published_at: "2025-06-30 16:01"
tags: ["cookies", "exfiltration", "session-security", "httponly", "tomcat", "cookie-parsing"]
phying_url: "https://phying.com/item/5048"
lang: en
---

# Stealing HttpOnly cookies with the cookie sandwich technique

## Summary

The cookie sandwich technique wraps a session cookie between quoted values and legacy $Version attributes, making Tomcat misparse the header and expose HttpOnly cookies to scripts.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2025-06-30 16:01
- **Original:** https://portswigger.net/research/stealing-httponly-cookies-with-the-cookie-sandwich-technique
- **Phying News:** https://phying.com/item/5048