Preventing Abuse of Cookies Stolen by XSS

Cross Site Scripting (XSS) makes victims execute an arbitrary script and leaks out personal information from victims´ computers. An adversary can easily get victim´s cookies by the XSS attack. If the adversary cannot use the stolen cookies to impersonate the victim, stealing cookie has no meaning. Therefore, we propose a method to prohibit the abuse of stolen cookies in order to make it ineffective to steal cookies through the XXS attack. The proposed method uses one-time password and challenge-response authentication to identify whether a person is a valid owner of the cookie or not.