3 ms·
But isn't that governed by the same origin policy, which cares about specific hosts (so a subdomain would be equally effective)?
by wyldfire 9y ago
But isn't that governed by the same origin policy, which cares about specific hosts (so a subdomain would be equally effective)?
- hdhzy 9y agoSubdomain can set a cookie for root domain [0] and that can lead to session fixation attacks. Cookies are not subject to CORS. [0]: https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-cookie-domains/ https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-c...