New CRLF Desync Attack Lets Hackers Steal HTTPOnly Cookies and Hijack Accounts

Security researchers Tom Stacey from PortSwigger and Tobia Righi from TurtleSec have introduced a new category of HTTP request smuggling attacks known as “CR...