4 ms·
If they mark the cookies as http only then that wouldn't be a concern though, for xss attacks anyway. Subdomains would also solve that issue. https://www.owasp
by theossuary 8y ago
If they mark the cookies as http only then that wouldn't be a concern though, for xss attacks anyway. Subdomains would also solve that issue.
https://www.owasp.org/index.php/HttpOnly https://www.owasp.org/index.php/HttpOnly
Personally I think they separate them out for branding. Things that are on google.com are flagship products, and getting your thing under google.com means you and/or you're project has a lot of clot at Google.
- londons_explore 8y agoHttponly wouldnt solve the issue - the serverside code also shouldn't be trusted with such cookies. Cookies aren't the only permission either - Google wouldn't want webcam or audio recording permission to be given to a 'withgoogle' site without the users consent either.