Exercise 2: HttpOnly Present vs. Absent — Possible Solution
====================================================================

THE TWO REAL RESPONSES
------------------------------
    r_on = Response()
    r_on.set_cookie('session_id', 'abc', http_only=True)
    print(dict(r_on.headers)['Set-Cookie'])

    r_off = Response()
    r_off.set_cookie('session_id', 'abc', http_only=False)
    print(dict(r_off.headers)['Set-Cookie'])

VERIFIED, REAL RESULT
------------------------------
    http_only=True:  session_id=abc; HttpOnly; Path=/; SameSite=Lax
    http_only=False: session_id=abc; Path=/; SameSite=Lax

The literal string "HttpOnly" is present in exactly one of the two
real header values and completely absent from the other - the flag
either is or isn't on the wire, nothing in between.

WHAT AN ATTACKER'S INJECTED SCRIPT COULD AND COULDN'T DO
------------------------------
Chapter 4's own real, verified XSS finding showed a naive, unescaped
template letting a genuine <script> tag reach the rendered page and
execute. With http_only=False, that injected script has a real,
working path to steal the session: document.cookie in a real browser
would include the session_id cookie in plain text, ready to be sent
to an attacker's own server with a single fetch() call - full account
takeover with no access to the victim's machine at all.

With http_only=True, a browser that honors the flag (every real,
modern one does) refuses to expose that specific cookie to
document.cookie, or to any other JavaScript API, no matter what script
is running on the page or how it got there. The XSS vulnerability from
Chapter 4 could still exist and still run - HttpOnly doesn't fix that
bug - but the one specific, high-value thing it can no longer do is
walk out the door with a live session ID.

WHY THIS WORKS AS AN ANSWER
------------------------------
It verifies the literal, real difference on the wire rather than just
describing the flag's purpose, and connects the consequence directly
to a concrete, already-verified vulnerability from an earlier chapter
instead of a hypothetical one - making the tradeoff genuinely
traceable rather than asserted.