Subdomain can set a cookie for root domain [0] and that can lead to session fixation attacks. Cookies are not subject to CORS. [0]: https://www.mxsasha.eu/blog

Subdomain can set a cookie for root domain [0] and that can lead to session fixation attacks. Cookies are not subject to CORS. [0]: https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-cookie-domains/ https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-c...