Soon after the popularity of XST, the TRACE method has been disabled by most web servers. Later, browsers' implementation of XMLHttpRequest also blocked "TRACE" method (i.e. xmlhttp.open('TRACE', url, true)]. Later, a flawed implementation in Firefox's XMLHttpRequest which can be used to access set-cookie response header was fixed.
JS Debugger pointing out "TRACE" method as invalid arugment JS Debugger pointing out "TRACE" method as illegal value A Sla.ckers.org forum member, LeverOne, posted ways to access HttpOnly cookie through the use of Java API and applet. I reproduced his techniques. When the first method was tried, the Java Runtime did not allow the HTTP TRACE method any more. …
We have been seeing authentication session ID appeared in URL Query String/REST URI and page body. The use of session ID in Query String is to enable session tracking for web browsers which disable or do not support browser-based cookie mechanism. This is commonly seen in Java web applications and cookieless mechanism in ASP.net web applications.
From what we have seen so far, the session ID in page body is used as anti Cross Site Request Forgery token or anti-cache parameter though it is not very common. The Problem