5 ms·
I think it's only true as long as every *.micro.blog subdomain is properly isolated, and you can't access cookies/sessions from micro.blog (e.g post/comment as
by Aissen 8y ago
I think it's only true as long as every *.micro.blog subdomain is properly isolated, and you can't access cookies/sessions from micro.blog (e.g post/comment as someone else, if there's no CSRF token). I haven't checked, but hopefully it's the case here. See:
https://security.stackexchange.com/questions/95369/persistent-xss-in-blogger-domain https://security.stackexchange.com/questions/95369/persisten...
- quickthrower2 8y agoDifferent subdomains are different origins. So it's safe.
- albinowax_ 8y agoIt's not quite that simple once cookies (and Internet Explorer/Edge) get involved. But it definitely could be secure.
- teleclimber 8y agoNot quite. There are gotchas: https://blog.github.com/2013-04-09-yummy-cookies-across-domains/ https://blog.github.com/2013-04-09-yummy-cookies-across-doma...