title: Login/session cookies, Ajax and security
body: <p>I'm trying to determine the most secure method for an ajax based login form to authenticate and set a client side cookie. I've seen things about XSS attacks such as this:</p>
  
  <p><a href="https://stackoverflow.com/questions/27972/are-httponly-cookies-a-viable-option-for-an-ajax-website">How do HttpOnly cookies work with AJAX requests?</a></p>
  
  <p>and</p>
  
  <p><a href="http://www.codinghorror.com/blog/archives/001167.html" rel="nofollow noreferrer">http://www.codinghorror.com/blog/archives/001167.html</a></p>
  
  <p>So, I guess my core questions are...</p>
  
  <p>1) Is using pure ajax to set cookies secure, if so, what is the most secure method (httpOnly + SSL + encrypted values, etc.)?</p>
  
  <p>2) Does a pure ajax method involve setting the cookie client side?  Is this at all secure?</p>
  
  <p>3) Is setting cookies this way reliable across all major browsers/OSs?</p>
  
  <p>4) Would using a hidden IFrame be any more secure (calling a web page to set the cookies)?</p>
  
  <p>5) If possible, does anybody have code for this (PHP is my backend)?</p>
  
  <p>My goal is to set the cookies and have them available for the next call to the server without navigating away from the page.</p>
  
  <p>I really want to nail down the consensus, most secure way to do this.  Eventually, this code is planned to be made Open Source, so please no commercial code (or nothing that wouldn't stand up to public scrutiny)</p>
  
  <p>Thanks,
  -Todd</p>