3 ms·
I like your idea but it's based on false assumptions. See RFC6265. Depending on the implementation on the backend side (specifically the "Set-Cookie" header) it
by numlock86 7y ago
I like your idea but it's based on false assumptions. See RFC6265. Depending on the implementation on the backend side (specifically the "Set-Cookie" header) it's possible to handle a cookie generated on "www.example.com" on "example.com" or "sub.example.com" ... and all other possible combinations.
[1] https://tools.ietf.org/html/rfc6265 https://tools.ietf.org/html/rfc6265
- g105b 7y agoWith the correct configuration, www.example.com cookies do not leak over all subdomains, but it's impossible to configure example.com cookies to _not_ leak over all subdomains.
- colinsidoti 7y agoIf you omit the domain it shouldn't leak, though as with many things web it's browser-specific: https://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_path https://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_path