Python : HTTP header manipulation (cookies)

The application includes data from an untrusted source into cookie. This leads to cache poisoning, XSS, page hijacking, and other types of attacks.

In conjunction with the cross-site scripting vulnerability allows an attacker to modify, extend, and even rewrite the user’s cookie. Since cookies are set in the header of HTTP response, absence of validation of data included into the cookie can also lead to HTTP response splitting attack.

Client side code injection attacks take the first place in the “OWASP Top 10 2017” web application vulnerabilities ranking. The level of potential damage from such an attack depends on the user input validation performance and file protection mechanisms.