3 ms·

It does? How so?

• Sohcahtoa82 8y ago
  According to this blog post[0], IE misbehaves with cookies and allows breaking SOP. The spec says that a cookie flagged with the domain "domain.com" is supposed to only be valid for requests to "domain.com" and not "subdomain.domain.com". A cookie that is intended to be valid for all subdomains is supposed to have a preceding dot, like ".domain.com". Older versions of IE (That may still be in use) will treat "domain.com" cookies like ".domain.com" cookies, allowing malicious.subdomain.domain.com to access cookies only intended for "domain.com". [0] https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-cookie-domains/ https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-c...